Closed
Bug 576788
Opened 15 years ago
Closed 15 years ago
PRIVACY: history sniffing though javascript or CSS
Categories
(Core :: Security, defect)
Core
Security
Tracking
()
RESOLVED
DUPLICATE
of bug 147777
People
(Reporter: gionnico, Unassigned)
References
()
Details
User-Agent: Mozilla/5.0 (X11; U; Linux i686; it; rv:1.9.2.6) Gecko/20100628 Firefox/3.6.6
Build Identifier:
As the website proofs:
http://whattheinternetknowsaboutyou.com
It's possible to use javascript's getPropertyValue("color") or CSS like this
a#link1:visited { background-image: url(/log?link1_was_visited); }
To create a list of websites the user has visited.
A more sophisticate script can guess user search engine keywords, username or even the latest news he've clicked (if the malicious website loads its list using Live RSS for example).
The issue is now impossible to stop, at least because there is no CSS protection. It is cross-browser, it *might* also affect thunderbird, though I know it has strict policies about all the HTML stuff.
Reproducible: Always
|
||
Comment 1•15 years ago
|
||
This has been known for quite some time. You didn't need to file a new bug. In the future, please search before posting.
In any case, this has been fixed for Firefox 4.
https://developer.mozilla.org/en/CSS/Privacy_and_the_:visited_selector
Status: UNCONFIRMED → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•