Re[4]: [Full-disclosure] Update: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari, Opera, Chrome, Seamonkey, iPhone, iPod, Wii, PS3....

["Steven M. Christey" <coley@xxxxxxxxxxxxxxx>]

On Tue, 21 Jul 2009, Thierry Zoller wrote:

> Yeah, security is too complex.  Dude, the fix was to LIMIT the the
> number of elements. This is not rocket science.

I believe Michal and I are having the conversation in a larger context.
What you found is valid on its own merit and got addressed, which is
great.  But now think of the whole ECMAScript API and there are probably
dozens or hundreds of such functions that would expose similar issues.
There could be a lot of individual reports for each individual function,
or one concerted effort that looks at everything at once.  (I'm not saying
you should have done this - after all it's your research - I'm just saying
that *somebody* could.)  Extend this to things like web-connected
interpreters (PHP anyone?) and similar logic may well apply.

I'm sure that I've generated web pages with about 10,000 elements, so now
it sounds like this simple "select" fix could break that.  (Maybe I didn't
have any business doing such gruesome things, but it wasn't technically
incorrect to do so.)

- Steve