miscoded

A new browser.js file is out, and like last time I'll post a changeblog with some background information. (I might spin these posts off to a separate blog at some point but for now it's here.)

First, some headlines:

• Sun System Messenger Express webmail fix.
  
• eBay.fr will no longer hang
  
• Finding a doctor in South Carolina becomes easier, thanks to fearphage
  
• Removed patch for maps.live.com - reborn at Bing maps
  
• Conflict between Salesforce and WebForms2
  

Sun System Messenger Express webmail fix.

Opera 10 aligns the policy for setting document.domain with the other browsers, and require both pages to set document.domain before allowing communication. (In other words, if www.example.com wants to talk to example.com both of them must set document.domain to 'example.com'. In the old implementation, only the content from www.example.com would have to do so).

Normally, aligning with the other browsers shouldn't cause problems - but unfortunately, I've noticed that certain sites use browser sniffing before setting document.domain! I have no idea why.

For example, Facebook uses this oddity to avoid setting document.domain in certain older Firefox versions:

if (navigator && navigator.userAgent && document.domain.toLowerCase().match(/(^|\.)facebook\..*/) && !(parseInt((/Gecko\/([0-9]+)/.exec(navigator.userAgent) || []).pop(), 10) <= 20060508)) { document.domain = window.location.hostname.replace(/^.*(facebook\..*)$/i, '$1'); }

I wish I knew why it's such a bad idea to set document.domain in Firefox-versions released before May 8, 2006..

Similarly, a webmail suite from Sun which is used by big universities and such contains this sniffing:

var agt=navigator.userAgent.toLowerCase();

var is_nav  = ((agt.indexOf('mozilla')!=-1) && (agt.indexOf('spoofer')==-1)
            && (agt.indexOf('compatible') == -1) && (agt.indexOf('opera')==-1)
            && (agt.indexOf('webtv')==-1) && (agt.indexOf('hotjava')==-1));
var is_gecko = (agt.indexOf('gecko') != -1);

if(is_nav || is_gecko) document.domain = document.domain
//document.domain = document.domain

and they run right into the new security policy when the sniffing means they avoid setting document.domain and all sorts of things break.

To solve this, each time we're about to run a script named setdomain.js or load a file named sample_lr.html - on any website - Opera will first append "Gecko" to its navigator.userAgent string. Oh, the weird and whacky things you need to do for compatibility.

eBay.fr will no longer hang

eBay.fr uses the SELECT.remove() method, but with element nodes instead of numbers as arguments. Their spec violation, our problem. This will be fixed in core, to allow using remove() for OPTION nodes like other browsers do - meanwhile, browser.js will sort it out for eBay.

Finding a doctor in South Carolina becomes easier

Do I have any readers in South Carolina? Thanks to fearphage's neat emulation of IE's bugfeature which lets you find a named form element with document.getElementById(), you can now use Blue Cross Doctor and Hospital Finder even though it relies on IE's violations against the DOM standard. The patch has been waiting while we were trying to get through to someone at Blue Cross Blue Shield who might be able to fix it, time is up - and big thanks to fearphage!

Removed patch for maps.live.com

Now maps.live is Bing Maps. No point in applying patches for the old hostname anymore.

Conflict between Salesforce and WebForms2 / HTML5

A report wizard inside Salesforce.com fails in Opera because of our support for the data attribute from WebForms2.

When they do

<select id="typeSelector" name="type" onchange="fillSelectFromArray(document.report_select.rep, ((this.selectedIndex == -1) ? null : data[document.getElementById('typeSelector').selectedIndex]));" title="Report Type Category"> 

"data" doesn't refer to the global variable data but to the data property on the SELECT object due to the scope of the event handler.

This attribute has since been removed from HTML5 so Opera will drop it at some point. Meanwhile, another stopgap site patch makes Salesforce work.

The 9sky.com fix in the previous edition was also about a problem caused by HTML5. Standards development and experimental implementations is obviously a major compatibility risk. If we want to improve the web's underlying technologies there isn't any other way forward, though.

Just a small tip to those of you who kindly try to help others on the forums: if you're discussing issues that are fixed by browser.js you sometimes come across users who have the feature disabled or are stuck with older files for whatever reason. Now you can just point them to the official documentation page which contains new step-by-step instructions for how to enable browser.js if it's disabled and force a new update manually if it's outdated.

There is a link to the new instructions from the "browser.js is disabled" message, so it should be pretty obvious how to solve that particular problem.

Hope this makes it just a little bit easier for you to help other users. While I'm at it let me say that I'm very proud of all our helpful Opera users and the general supportiveness of the community when people have technical problems. I mention no nicks or names, because you helpers out there know who you are. Your participation on the My Opera fora is greatly appreciated!

At this point most readers of this blog will have noticed the latest Adobe Acrobat security issue (see links at the bottom of this post if you haven't). In brief, an Acrobat PDF plugin feature lets an attacker run JavaScript of their choice on any site that hosts PDFs.

To put that into perspective, I am aware of several online banks that have a "mailbox" feature where you can see official letters from the bank to you in a PDF format. A malicious attacker could gain complete control of your online banking interface, for example inject malicious code to perform money transfer, by making you click a link of the form

https://examplebank.com/mailbox/letter1.pdf#arg=javascript:some_javascript_here

Even if you are technical enough to check that protocol and hostname of that link are OK, it is easy to overlook the abnormal and dangerous bit at the end. And it works in any browser using the NSAPI plugin - for example Opera and Firefox. This exploit is very dangerous indeed!

The blame and responsibility for fixing it lies with Adobe. Fortunately, they've resolved the issue in Acrobat Reader 8 - but most users are as we know slow at updating their systems..

So, I'm happy to announce that most cases of this exploit no longer work in Opera.

Yesterday we published a browser.js update for all public versions of Opera greater than 8.01 which disables the exploit for all files that have a .pdf extension. Normally, this update will be downloaded by all Opera installations within a week from now - to get it faster just choose "Help > Check for updates". You may see a message saying no updates are available but the new browser.js will have been downloaded.

I will work a bit more on the patch to see if I can write a version that gives complete protection also for files without .pdf in the address, but you're already much safer with PDF security patch version 1.

It's the first time we've published a generic security issue fix in browser.js. Hopefully it won't happen often but it is interesting to see site patching applied in the security domain.

More information about the security issue and its consequences:

Official advisory:
http://www.adobe.com/support/security/advisories/apsa07-01.html

Other related links:
http://www.gnucitizen.org/blog/danger-danger-danger/
http://www.securityfocus.com/brief/401?ref=rss
http://www.symantec.com/enterprise/security_response/weblog/2007/01/when_pdfs_attack.html
http://www.gnucitizen.org/blog/universal-pdf-xss-after-party/

And, in case you're curious this is the patch itself (in a somewhat more readable format than in browser.js itself):

opera.addEventListener('BeforeJavaScriptURL', function( e ){
var pathname=unescape(self.location.pathname.toLowerCase());
var hash=unescape(self.location.hash.toLowerCase());
if( pathname.indexOf('.pdf')>-1 && hash  &&  hash.indexOf('javascript:')>-1   ) e.preventDefault();
}, false);