> > This is not a drill. The URL above, which I trust you intended to be
> > simply informative, instead completely wedges Firefox

Signature
C. Benson Manica | I appreciate all corrections, polite or otherwise.
cbmanica(at)gmail.com |
----------------------| I do not currently read any posts posted through
sdf.lonestar.org | Google groups, due to rampant unchecked spam.
On Jul 27, 5:02 pm, Christopher Benson-Manica
<at...@faeroes.freeshell.org> wrote:
> > > On Jul 26, 11:19 am, Roedy Green <see_webs...@mindprod.com.invalid>
> > > wrote:
[quoted text clipped - 4 lines]
> What, just because a page toasts Firefox it's indicative of some kind
> of security flaw?
That's a denial-of-service attack, even assuming it wasn't an attempt
at something worse.
> *shrug* Firefox may not be M$ crap, but it's got bugs.
Evidently. And trying to exploit them, as the defaced site code
evidently did, is still an attack even if they aren't M$ bugs.
Most likely the evil script someone snuck in there tried to do
something that would have compromised a sufficiently out of date IE
and, being malformed in some way in order to exploit that bug, also
tripped a less severe bug in Firefox.
> Looking at the page source, however, I see no <iframe> tags at
> all, nor any particularly unsavory-looking script, nor does Firefox so
> much as blink.
That's because it was fixed (indeed, within 1 hour of my reporting
it). Nonetheless that page did crash Firefox and no longer does,
meaning something on that page changed. I find it highly unlikely that
someone of Roedy's reputation constructed the page to crash Firefox in
the first place, which suggests it actually changed to do so and then
changed BACK. The first change would be a defacement perpetrated by
someone else not authorized by Roedy to alter his Web site's code and
the second would be Roedy undoing the damage after receiving a heads-
up.
Unless you have an alternative theory to explain it? (Other than that
I'm simply making this up, a theory that I know to be false even if I
can't prove it to anyone else -- since the browser hung as soon as it
tried to load the page I had no way of getting a look at the page
source until it was fixed, whereupon obviously there'd be nothing
relevant to see in said source anymore, so I don't have and could
never have had a copy of the source with the malicious edit still
intact. And I was sure as *hell* not going to try to access it in IE
to get a look at the source! Maybe I should have tried viewing it in
FF with JS disabled but it didn't occur to me until it was too late
and the page had been fixed.)
RedGrittyBrick - 28 Jul 2007 12:54 GMT
> since the browser hung as soon as it tried to load the page I had no
> way of getting a look at the page source until it was fixed,
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLConnection;
public class Wget {
public static void main(String[] args) throws Exception {
URL url = new URL("http://mindprod.com/products1.html#BULK");
URLConnection connection = url.openConnection();
HttpURLConnection httpConn = (HttpURLConnection) connection;
InputStreamReader isr =
new InputStreamReader(httpConn.getInputStream());
BufferedReader in = new BufferedReader(isr);
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
}
}