Recent Features
| |||||||||||||
Confused deputyConfused deputyPosted Jul 28, 2005 3:55 UTC (Thu) by bignose (subscriber, #40)Parent article: Greasemonkey gets into trouble
This problem is endemic in the security model of most mainstream operating systems and application environments. It is known as the "confused deputy" problem:
http://en.wikipedia.org/wiki/Confused_deputy_problem
and the prime candidate for solution is a candidate-based security model:
http://en.wikipedia.org/wiki/Capability-based_security
(Log in to post comments)
Confused deputy Posted Jul 28, 2005 4:45 UTC (Thu) by jwb (guest, #15467) [Link] No, it really isn't. The problem here is that greasemonkey works by injecting strings into an untrusted markup stream, when it should have been programmatically fiddling the model using priviledged APIs. Mozilla already has the the security model you recommend, but greasemonkey poked a big hole in it.
|
|||||||||||||