Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of paul.joseph.davis@gmail.com
 designates 209.85.210.198 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :content-type:content-transfer-encoding;
        b=o6ROtgOF4mIBQTZ6YQ0dxlnCnBEmR3uEwIuhmpDNgCrYIXGw0pDGF9h2zsFzckrnnI
         C2gABsgCczjOugyHbi6vWW14Ir3hD+k89XdAJZOni3zLPxXjDvqh0kjXUDvFVejexHg5
         ty+NncL/7zFP3rgIDPyl5OTGpc/u28IMVnohM=
MIME-Version: 1.0
In-Reply-To: <87bpfnbnzn.fsf@mid.deneb.enyo.de>
References: <87bpfz5t39.fsf@mid.deneb.enyo.de>
 <150F65D6-87CE-4C90-8242-F639F3B3B48D@apache.org>
	<87bpfnbnzn.fsf@mid.deneb.enyo.de>
From: Paul Davis <paul.joseph.davis@gmail.com>
Date: Wed, 17 Feb 2010 16:46:51 -0500
Message-ID: <e2111bbb1002171346l5a8cefban6db9a2e04efd9381@mail.gmail.com>
Subject: Re: Futon cannot use the RESTful HTTP API
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Florian,

Do you have any examples of how other sites have protected against
this? Unless I'm missing something I don't see how this is specific to
Futon so surely someone else has some explicit documentation on how to
avoid such things.

Thanks,
Paul Davis

On Wed, Feb 17, 2010 at 3:34 PM, Florian Weimer <fw@deneb.enyo.de> wrote:
> * Jan Lehnardt:
>
>> thanks for reporting this, but I'm not I understand what's supposed to b=
e
>> going on. Can I ask you to explain in a little more detail what your con=
cerns
>> are?
>
> If you have an open Futon session, any web site you visit can write to
> the Futon database, provided that the URL to the CouchDB instance is
> known. =A0This is because browsers do not prevent cross-domain POST
> requests using XMLHttpRequest. =A0The Futon session cookie will not be
> transmitted by some browsers due to the HttpOnly flag. =A0(Regular
> form-based POSTs not appear to work as the content type is not
> correct.)
>
> Anyone who can write to the CouchDB instance can upload an HTML
> document which contains embedded Javascript as an attachment to a
> document which is reachable with a fixed URL. =A0If a Futon user loads
> this document accidentally (or loading it is forced by a malicous web
> page that is displayed with an open Futon session), the Javascript
> executes with full access to the database (read and write access,
> including PUT etc. methods). =A0This risk also exists if the browser
> supports HttpOnly cookies.
>
> Is this description more clear?
>