[dokuwiki] Suggested new config option: acceptable protocol handlers in links
From: Walter Rader <waltergr@xxxxxxx>
To: dokuwiki@xxxxxxxxxxxxx
Date: Thu, 14 Jun 2007 17:02:44 -0700
I had an e-mail thread going with Andi and he suggested I bring it to
the mailing list for additional feedback.
Links embedded in DokuWiki pages can use arbitrary protocol handlers,
for example the shell: protocol handler. While browsers usually block
this particular handler, allowing the user to specify arbitrary handlers
in links (in combination with a protocol handler vulnerability in the
browser, OS, or 3rd party software) opens the possibility of a malicious
user utilizing a DokuWiki installation to compromise other visitors.
Both Firefox and IE will pass un-handled protocol handlers to the
operating system. (Probably other browsers as well.) If there's a
vulnerability in the protocol handler, a malicious user could place a
link in a DokuWiki installation which exploits this.
There have been protocol handler vulnerabilities in the past, e.g. a BO
in Windows' gopher protocol handler, a telnet handler vuln. in Opera,
shell handler vuln. in Firefox, etc.
Suggestion:
Add a config option to specify the acceptable protocol handlers in
links. Set the DokuWiki installation default to (say) http, https, and ftp.
