Possible security vulnerability

[Miquel 'Fire' Burns]

Back porting old versions of the RDF, and when the user's too lazy to make a proper wildcard setup.

[tanstaafl]

Back porting old versions of the RDF,

I'm speaking mainly to the creation of *new* filters. I do agree that the users old/existing RDF file should still be converted, but with a big fat warning notice. Maybe even a warning notice right on the MPW Prompt window - and maybe even go so far as to disable the 'auto-populate' function for accounts that have what PWM would consider to be 'vulnerable' URL patterns...

and when the user's too lazy to make a proper wildcard setup.

Well, this is a reason, yes, but I disagree completely that it is a *good* reason.

[adamspiers]

Here's a simple user-friendly solution for the security risk people have been worrying about in this thread: in wildcard mode, stop a normal * glob from matching forward slashes, and also have a new glob syntax ** which does match them.  Then you can safely recommend users to use wildcards like:

  *://*.yahoo.com/**

[Frosty]

I am currently using this regex setup to detect domains,

https?://([^/]*\.)*domain.com/

If you copied the options from the "Default" section for the part of the URL to match, people could set this up however they wanted.


pic: Defaults option page.

[Miquel 'Fire' Burns]

Need to add .* at the end of that RegEx setup. Otherwise, good work.

[tanstaafl]

I am currently using this regex setup to detect domains,

https?://([^/]*\.)*domain.com/

If you copied the options from the "Default" section for the part of the URL to match, people could set this up however they wanted.

IPB Image
pic: Defaults option page.

Need to add .* at the end of that RegEx setup. Otherwise, good work.

Hmmm...

Ok, can this be clarified? I'm a total newb when it comes to regex...

What this is saying is the best way to prevent phishing attackes with PM is to use the following regex pattern instead of wildcards:

"https?://([^/]*\.)*domain.com/.*"

Minus the quotes, of course...

Is this correct?

[Miquel 'Fire' Burns]

Hmmm...

Ok, can this be clarified? I'm a total newb when it comes to regex...

What this is saying is the best way to prevent phishing attackes with PM is to use the following regex pattern instead of wildcards:

"https?://([^/]*\.)*domain.com/.*"

Minus the quotes, of course...

Is this correct?

That regex is almost like the wildcard http://*.domain.com/* (The .* at the end is just like the wildcard character * actually)

I'll break down that regex pattern:

It has to start with 'http', then there may or may not be an 's' (That's what the ? after the s means), then it must be '://' The "(..)*" menas there must be zero or more of the bit in the ()'s (That * should be a ? really with the way the stuff on the inside is.), in side, the "[^/]*" bit means zero or more of any character that is not a '/', and '\.' means '.', and as I said before, .* is just like the wildcard *

[tanstaafl]

kewl! Thanks for the in-depth explanation...

One last question...

Is there a way in the wildcard expression to designate a character as optional? I.e., in your regex, you have 'https?', where the '?' means the s is optional - is there a way to do that in the wildcard expression? That one thing would mean I can quit adding two entries for every account (usually create a plain and one with the s for my important accounts, just in case), so if I need to change these to regex patterns, I'll happily do so.

Thanks!

[Miquel 'Fire' Burns]

Wildcard doesn't allow for that. Only one character (?) or multiple characters (*)

[Eric H. Jung]

Nice job, Frosty.

[tanstaafl]

Thanks miquelfire...

Now I test a little, then start the slow process of converting all of my accounts...