If an attacker were somehow able to cause files to be created in the user's home directory so that the "find" command returns the wrong file. None of these items are ever exposed to a command line, either directly or by output within a backtick construct- the only things in backticks are the "find" command which locates Firefox's bookmarks.html file, and the word "uuidgen" which is a command to generate UUID numbers which are used as unique filenames. the dangerous items, the items which could potentially be controlled by the operator of a malicious web site, are the URL, the page title, and the icon. considering it's suggested to run it every 10 minutes.) Ex: find ~/Library/Application\ Support/Firefox/Profiles/ -name 'bookmarks.html'If your home is quite large, you'll notice a bit of chugging while looking for stuff in the authour's version (esp. As far as I know, Firefox keeps it's stuff in a known location.
Aborting.Īlso, the 'find' command can be a little more precise. mdimport Expected bookmark file to be a CFDictionary bu it isn't.
Maybe somebody could confirm this, though? Not a problem though, since there's no need to index these and the real bookmarks got in just fine. I suspect this is being triggered by your pattern matching having an issue with all the (un)escaping that typically goes on in javascript bookmarklets. While testing, I noticed that I couldn't see results immediately without manually running mdimport on the new Firefox metadata directory, as: mdimport ~/Library/Caches/Metadata/Firefox/Perhaps this might be useful in the script?ĭoing so produced several errors, but the number of errors appears to correspond to the number of "bookmarklet" bookmarks I have.
0 kommentar(er)
