[Webkit-unassigned] [Bug 22199] New: Safari, like other browsers, actually parses and runs code in favicon.ico

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=22199

           Summary: Safari, like other browsers, actually parses and runs
                    code in favicon.ico
           Product: WebKit
           Version: 312.x
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: New Bugs
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: scott at newgeo.com


It took me a while to track down, a clients website was compromised.  The
attacker gained access to the site, and stuffed a http redirect in favicon.ico.

This seems to work on all browsers, including Safari Mobile as well.  I am
unable to determine a reason why favicon.ico would decode anything by an image
format.  It is crafty place to store a redirection, the last place I looked.  

What makes this so interesting, is that a first visit will redirect, but then
the icon is cached.  You will end up thinking it was a fluke, as the redirect
will not execute again, unless you clear caches of icons.

I suggest that faviicon simply not execute any html or javascript in it.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.