Re: Signed Jar in JSP / Firefox 2.0.0.15

2010-08-19 Thread Marine Wacheux - ARMOR Technologies
Boris Zbarsky a écrit : Marine wrote: The webpage have to be able to expose some values/parameters to the extension. So I tried to add properties to button, to document or to window objects, in my webpage. The problem is that reading those from chrome would be exploitable (by the web

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-28 Thread Marine
Boris Zbarsky a écrit : > Marine wrote: > >> The webpage have to be able to expose some values/parameters to the >> extension. >> So I tried to add properties to button, to document or to window >> objects, in my webpage. >> > > The problem is that reading those from chrome would be explo

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-25 Thread Boris Zbarsky
Marine wrote: > The webpage have to be able to expose some values/parameters to the > extension. > So I tried to add properties to button, to document or to window > objects, in my webpage. The problem is that reading those from chrome would be exploitable (by the webpage). You can do it if yo

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-25 Thread Marine
Marine a écrit : > Jonas Sicking a écrit : >> Marine wrote: >> >>> Boris Zbarsky a écrit : >>> Marine wrote: > However, I don't see how to put all the code in a signed jar, as > JSP will generate HTML code dynamically for each client request. > Is

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-25 Thread Marine
Jonas Sicking a écrit : > Marine wrote: > >> Boris Zbarsky a écrit : >> >>> Marine wrote: >>> >>> However, I don't see how to put all the code in a signed jar, as JSP will generate HTML code dynamically for each client request. >>> Is it possible to dynam

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-24 Thread Jonas Sicking
Marine wrote: > Boris Zbarsky a écrit : >> Marine wrote: >> >>> However, I don't see how to put all the code in a signed jar, as JSP >>> will generate HTML code dynamically for each client request. >> >> Is it possible to dynamically generate the signed jar? Or move the >> logic from server

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-23 Thread Marine
Boris Zbarsky a écrit : Marine wrote: However, I don't see how to put all the code in a signed jar, as JSP will generate HTML code dynamically for each client request. Is it possible to dynamically generate the signed jar? Or move the logic from server to client?

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-23 Thread Boris Zbarsky
Marine wrote: > However, I don't see how to put all the code in a signed jar, as JSP > will generate HTML code dynamically for each client request. Is it possible to dynamically generate the signed jar? Or move the logic from server to client? I don't claim this is easy to do, basically. The

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-23 Thread Marine
Thanks a lot for your reply, Boris ! However, I don't see  how to put all the code in a signed jar, as JSP will generate HTML code dynamically for each client request. Maybe someone know if this is possible, and how ? Otherwise, I will have to write an extension, as you suggested, but I would

Re: Signed Jar in JSP / Firefox 2.0.0.15

2008-07-23 Thread Boris Zbarsky
Marine wrote: > > width="0px" height="0px" name="jsUtilsAvecPrivileges"> > ... > I wonder if this could be due to vulnerability correction in Firefox > 2.0.0.15 : http://www.mozilla.org/security/announce/2008/mfsa2008-23.html Yes. What you were doing before was exploitable. > ==> But now, h

Signed Jar in JSP / Firefox 2.0.0.15

2008-07-23 Thread Marine
Hi, A few months ago, I posted this message : http://groups.google.com/group/mozilla.dev.security/browse_thread/thread/d95d4d9d82959739/da0875e5639698c2?lnk=gst&q=signed+jar#da0875e5639698c2 I wanted to call JavaScript methods that require special Firefox privileges from a JSP page I finally su