With Javascript 1.7 being implemented in Firefox 2.0, new features are now available to developers. One of these features is session and persistent data storage on the client side using the new DOM Storage API. We have the ability to store session data, or persistent data, which is really cool from a developers point of few, something I will be making use of, and already have put to use in a project.
Now comes the problem for remotely hosted forum services like ProBoards / InvisionFree / insert other here. When you sign up for a forum, you are given a sub domain name like http://username.server.com or http://server.domain.com/user/. So for example if you register a ProBoards forum, you will get something like http://username.proboardsXX.com where XX is the server number. One server could have thousands of forums.
Throughout this I will be using ProBoards as an example, but the same problem exists for other hosting services most likely.
Now, when you set a session variable, it can only be accessed on the forum it is set, which is a good thing, so no danger there. But if we use the persistent API (global storage), we can set the global storage domain to the server (i.e proboards17.com), we can then store any information we want, good thing about this is we can store information and recall it next time the user visits, and this includes closing the browser, as the data is persistent. Cool right? Nope, not really, let me explain…
Lets say I have a forum on server 77, and someone is using a hack of mine from the database (Javascript code that gets placed in the header or footer), and they are also on server 77. The hack doesn’t even need to be in a remote JS file, it can just be a simple “Total visits to this forum” counter for the member, they wouldn’t know what the code really does, because what it would be doing, is storing the username and password in the storage object. Now let’s say that user visits my forum (also on server 77), I then have easy access to record that users username and password from the forum the hack was being used at, I could then send that data to a database to record it.
Isn’t a great deal that can be done to prevent it. Maybe there should be a global flag that can be only used once in the document, this flag could be set to 0 or 1 (false / true) and would be set in the head tag, as most hosting services only allow code inputting inside the body tag. So the flag would not be changeable else where in the document, thus preventing attacks.
Your thoughts?