Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Fri, Jan 30, 2004 at 06:33:41PM -0500, john collins wrote:
> Regarding the recent IE deal with the spoofed url's, would anyone attempt to
> explain to me why this problem occurs in IE but not any other browser, on a
> layman-technical level?

Because IE was coded by people with other things on their minds, has
been written using a model that requires the app to share its basic
libraries with literally hundreds of other applications, and so cannot
be easily updated without breaking other, poorly written applications.

And because - and here's the gist - when IE reads the URL in preparation
for displaying it as a string in the status bar, it performs a step
known as "entity decoding" as well as "URLdecoding". Strings of characters
in URLs are often encoded using a scheme based on a conversion of the
character's ASCII value, or order in a commonly used character set, 
into hexadecimal, then prepended with a '%'. So, A has a hex ASCII code
of '41', if you needed to encode an A, you'd use '%41'. This is more often
used to encode non-printing characters like space (decimal 32, hex 20,
so urlencoded as '%20') but Microsoft made sure that /any/ character could
be encoded and would be decoded.

The Baddies can put a URLEncoded "null" character (%00 -> converts to
ASCII 0) into the URL. When IE reads the string, and encounters the
encoded null, it converts it into a real null character, which is used
in C applications to delimit strings. So, the string displayed in the
status bar is the string found in the URL, up to the now-decoded null
character.

That's my guess, anyway. Oh, and FWIW, my copy of Mozilla 1.3 for OS X
has the same bug, though it's been fixed in 1.5 and in Firebird,
apparently. So it's fun to bash MS for issuing stupid instructions, but
be careful before you assume that other software is safe.

Steve

-- 
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier