« Adobe AIR 1.1 now in the wild | Main | Top 10 AIR apps worth Installing »
Flex 3 HistoryManager Exploit?
| By Rich Tretola | June 18, 2008 |  Print This Post
|
  (1 votes, average: 1 out of 5) Loading ... | 426 views |
I was just reading this article this morning about an exploit in the historyFrame.html file of the Flex 3.01 SDK.
The article states that Flex 3.01 SDK contains this vulnerability and that the issue was fixed with the Flex 3.02 build. I downloaded build 3.0.2.2095 dated June 17, 2008 and compared the historyFrame.html and history.js files with my 3.0.0 and 3.0.1.1739 builds and saw no differences.
UPDATED: I just downloaded a special fix zip file which includes a new historyFrame.html file which does have the patch.
Here is the original Flex 3.0.1 historyFrame.html file:
- <html>
- <head>
- <meta HTTP-EQUIV="Pragma" CONTENT="no-cache">
- <meta HTTP-EQUIV="Expires" CONTENT="-1">
- </head>
- <body>
- <script>
- function processUrl()
- {
- var pos = url.indexOf("?");
- url = pos != -1 ? url.substr(pos + 1) : "";
- if (!parent._ie_firstload) {
- parent.BrowserHistory.setBrowserURL(url);
- try {
- parent.BrowserHistory.browserURLChange(url);
- } catch(e) { }
- } else {
- parent._ie_firstload = false;
- }
- }
- var url = document.location.href;
- processUrl();
- document.write(url);
- </script>
- Hidden frame for Browser History support.
- </body>
- </html>
Here is the updated historyFrame.html file:
- <html>
- <head>
- <meta HTTP-EQUIV="Pragma" CONTENT="no-cache">
- <meta HTTP-EQUIV="Expires" CONTENT="-1">
- </head>
- <body>
- <script>
- function processUrl()
- {
- var pos = url.indexOf("?");
- url = pos != -1 ? url.substr(pos + 1) : "";
- if (!parent._ie_firstload) {
- parent.BrowserHistory.setBrowserURL(url);
- try {
- parent.BrowserHistory.browserURLChange(url);
- } catch(e) { }
- } else {
- parent._ie_firstload = false;
- }
- }
- var url = document.location.href;
- processUrl();
- document.write(encodeURIComponent(url));
- </script>
- Hidden frame for Browser History support.
- </body>
- </html>
The difference is that on line 25 the url is now encoded with encodeURIComponent.
Topics: Flex, Flex 3 (Moxie) |
June 18th, 2008 at 11:41 am
The 3.0.2.2113 build does have the fix in it.
June 18th, 2008 at 1:07 pm
Ah, thanks Matt, I grabbed the nightly dated June 17th rather than the stable with the same date.