Firefox 57 to Get New XSS Protections

Mozilla this week announced plans to boost the Cross-Site-Scripting (XSS) protections in Firefox by treating data URLs as unique origin.
The use of a data URL scheme allows web developers to inline small files directly into HTML or CSS documents, which also results in faster page load times. Because of this mechanism, the browser doesn’t have to perform a large number of HTTP requests to load external resources, as they are already in the page.
万通地产:募集资金存放与实际使用情况的专项报告
However, the same technique allows cybercriminals to craft attack pages and steal usernames, passwords, and other confidential information from unsuspecting users.
By embedding the entire attack code within the data URL, miscreants can launch attacks without having to actually host a full website. The data URL inherits the security context of the embedding element, and this inheritance model opens the door for Cross-Site-Scripting (XSS) attacks.
To prevent such attacks, Firefox 57 will treat data URLs as unique origins and will no longer inherit the origin of the settings object responsible for the navigation. Thus, data URLs loaded inside an iframe will no longer be same-origin with their parent document.
“Starting with Firefox 57, data URLs loaded inside an iframe will be considered cross-origin. Not only will that behavior mitigate the risk of XSS, it will also make Firefox standards compliant and consistent with the behavior of other browsers,” Mozilla notes in a blog post.
在遇有系统及数据升级、存档、存储、迁移、消除等需要系统终止运行情况,公司应该妥善处理,保证系统及数据安全。
However, the company also explains that data URLs that do not end up creating a scripting environment will continue to be considered same-origin. Data URLs in img elements will be treated as such, Mozilla says.
Because of the new security setting, Firefox 57 will block attempts to reach content from a different origin, such as when a script within a data URL iframe attempts to access objects from the embedding context. In Firefox version 56 and older, this was possible because the data URLs inherited the security context.

The security enhancement was announced the same week Mozilla revealed plans to completely remove support for Windows XP and Vista from Firefox starting June 2018. A couple of months ago, the company made the Adobe Flash plugin click-to-activate by default, thus further improving the security of its users.
Related: Firefox Support for Windows XP and Vista Ends June 2018
Related: Firefox Makes Adobe Flash Click-to-Activate by Default
信息安全很重要,如果没有强大的软件安全与保护技术,许多现代社会运作所依赖的基于软件的系统,如:电力、交通、通讯系统,医疗信息系统、数字版权管理系统、投票系统、财务系统等的核心部分,都将受到毁灭性的攻击。

猜您喜欢

加强青少年网络安全教育 培养中国互联网健康新力量
互联网金融您不知道的肮胀交易
网络安全法普法宣传 004《网络安全法》的突出亮点
奥迪+保时捷=?解析奥迪2.9T发动机
HEALTHPORTALSITE SUNNYSIDEBOWL
信息安全意识教育案例之商业黑客参与搜索引擎专利大战