Hacker News new | ask | show | jobs
by cesarb 1139 days ago
> A few things are effectively grandfathered in due to their vintage: /favicon.ico, /sitemap.xml and /robots.txt are the three that occur to me—so if you’re running something vaguely like S3, you’ll want to make sure users can’t create files at the top level of your domain matching at least those names.

I also recall /crossdomain.xml as an important one; allowing users to create an arbitrary file matching that name could allow certain kinds of cross-site attacks against your site.
1 comments
ehPReth 1139 days ago
I think crossdomain.xml died with Flash but I could be wrong, does anyone know?
link
roblabla 1139 days ago
None of the standardized web technologies use crossdomain.xml, but I think Acrobat Reader still uses it for... stuff. And acrobat still has a browser plugin, so I guess it's still a potential vector for abuse.
link
ehPReth 1139 days ago
ah! Reader. That's a fun one. I once encountered an "Acrobat Reader-only" PDF that after filling out and selecting any applicable attachments on your filesystem you then... literally put in your credentials to the website in the PDF so that it could.. submit itself. I lost some braincells seeing that..
link
capecodes 1139 days ago
Oh man, then you really don’t want to know about a product I once created.

Reader could have an optional Flash plugin, and better yet, you could configure the PDF interactive plugin to dynamically download the swf file to run.

I built an entire Flex based rich UI that was dynamically loaded by the 1kb PDF you’d receive in email, the Flex app retrieved and posted data via HTTP APIs.

Because reasons.

That product was live for years. I think we shut it down as recently as 2 years ago.

To be 100% clear, wasn’t my idea.

But it was my mistake to joke about the absurd possibility to build such a thing in front of some biz folks.

link
ehPReth 1139 days ago
oh looooooooooooord. O_O
link
ehPReth 1137 days ago
https://twitter.com/subtee/status/1654858616065732609?s=12

in an interesting coincidence, I found this today!

link
ehPReth 1138 days ago
impressive, but still haha
link
easrng 1139 days ago
But no browsers support 3rd-party plugins anymore. (I think the Chromium PDF viewer might be a plugin internally though?)
link