[Full-disclosure] Opera/Konqueror: data: URL scheme address bar spoofing

[Martin Aberastegue]

> Ummmmm -- what part of "address bar spoofing" did you not understand?
>
> _IF_ the URL spoofing part of a URL spoofing vulnerability in one
> browser does not work in another browser, then that other browser is
> clearly NOT vulnerable to the first browser's URL spoofing
> vulnerability.

I understand that...

> The issue Robert reported is NOT that Opera and Konqueror parse the
> data: protocol, BUT that cunning use of a data: protocol URL can be
> used to fool the user to think they're somewhere other than they are.
>
> As you so clearly -- and accurately -- say yourself, the URL spoofing
> part of this does not work in FF, so we should give a rat's arse that
> FF handles data: protocol URLs why?

ok.. see this pic..
http://www.rzw.com.ar/wp-content/uploads/2007/07/ff_spoof.jpg

as you said.. "that cunning use of a data: protocol URL can be used to
fool the user to think they're somewhere other than they are".. and
now tell me that inexperienced users can't be confused if they saw
something like that..., that's my point.



-- 
Martin Aberastegue
http://www.rzw.com.ar