Syntax - Mozilla

[Ken]

What is the correct syntax for fileSize in Mozilla?

This works in IE but not in Mozilla:

<input type=file size=65 name="picture1" onChange="image _size(this.valu e);"
Id="pt111">
<div id="image_size_ display"></div>
<script type="text/javascript">
// Image size to be under max limit
function image_size(fiel d){
if ((document.crea teElement) && (document.getEl ementById)) {
var image_display=d ocument.createE lement('img');
image_display.o nload = function() {
im_size = image_display.f ileSize;
}
image_display.s rc='file://' + field;
image_display.n ame = 'pict';
image_display.a lt = 'image';
document.getEle mentById('image _size_display') .appendChild(im age_display);
alert("im_size = " + im_size);
if(im_size >2000000){alert ("This picture ( file ) is geater than
2,000,000.\n\n" + "Select another picture or reduce the size of the picture
( file )")};
} }
</script>

Thanks.

Ken

[Randy Webb]

Re: Syntax - Mozilla

Ken wrote:
[color=blue]
> What is the correct syntax for fileSize in Mozilla?[/color]

There isn't one.
[color=blue]
> This works in IE but not in Mozilla:[/color]

Thats because the IE security model has as many holes in it as 87,000
kitchen strainers and you are exploiting one of them.

--
Randy
comp.lang.javas cript FAQ - http://jibbering.com/faq

[Ken]

Re: Syntax - Mozilla

"Randy Webb" <HikksNotAtHome @aol.com> wrote in message
news:mdudnSuMiY 9GxAzcRVn-pQ@comcast.com. ..[color=blue]
> Ken wrote:
>[color=green]
> > What is the correct syntax for fileSize in Mozilla?[/color]
>
> There isn't one.
>[color=green]
> > This works in IE but not in Mozilla:[/color]
>
> Thats because the IE security model has as many holes in it as 87,000
> kitchen strainers and you are exploiting one of them.
>
> --
> Randy
> comp.lang.javas cript FAQ - http://jibbering.com/faq[/color]

Randy,

What is the security problem if a program running on a personal computer
reads the file size on a his/her own computer?

It saves significant time of downloading a Mb file and then ending up with
no file because the size went over the MAX_FILE_SIZE.

I appreciate the responses.

Ken

[Andrew Thompson]

Re: Syntax - Mozilla

On Thu, 11 Nov 2004 03:56:51 GMT, Ken wrote:
[color=blue][color=green]
>> Thats because the IE security model has as many holes in it as 87,000
>> kitchen strainers and you are exploiting one of them.[/color][/color]
...[color=blue]
> What is the security problem if a program running on a personal computer
> reads the file size on a his/her own computer?[/color]

The moment a security hole becomes 'a' problem it is sealed - generally.

The issue is with the 4,328 uses that *might* cause a security problem
as well as the two you have not discovered yet that are security problems.

The first two potential security concerns with allowing file sizes
to be read are that the author of the script can
a) analyse the local file-system, by searcing for common files.
b) Test whether 'writes' are successful, by checking a file size
before and after a write attempt.

The other 4,326 are left as an exercise for the reader.

--
Andrew Thompson
http://www.PhySci.org/codes/ Web & IT Help
http://www.PhySci.org/ Open-source software suite
http://www.1point1C.org/ Science & Technology
http://www.LensEscapes.com/ Images that escape the mundane

[Grant Wagner]

Re: Syntax - Mozilla

Andrew Thompson wrote:
[color=blue]
> On Thu, 11 Nov 2004 03:56:51 GMT, Ken wrote:
>[color=green][color=darkred]
> >> Thats because the IE security model has as many holes in it as 87,000
> >> kitchen strainers and you are exploiting one of them.[/color][/color]
> ..[color=green]
> > What is the security problem if a program running on a personal computer
> > reads the file size on a his/her own computer?[/color]
>
> The moment a security hole becomes 'a' problem it is sealed - generally.
>
> The issue is with the 4,328 uses that *might* cause a security problem
> as well as the two you have not discovered yet that are security problems.
>
> The first two potential security concerns with allowing file sizes
> to be read are that the author of the script can
> a) analyse the local file-system, by searcing for common files.[/color]

No, because the "trick" uses (new Image()).src. If you attempt to load any
file type other than an image, the onerror, not onload event gets triggered.
As a result, it's impossible to determine the size of any file type other than
real images.

<script type="text/javascript">
var loadFile = new Image();
loadFile.onload = function() {
alert('Loaded: ' + this.fileSize);
}
loadFile.onerro r = function() {
alert('Error: ' + this.fileSize);
}
</script>
<a href="#" onclick="loadFi le.src =
'c:\\windows\\w eb\\wallpaper\\ Home.jpg';retur n false;">Load Home.jpg</a>
<!-- the above alerts "Loaded: 42728" (Windows XP) -->
<a href="#" onclick="loadFi le.src =
'c:\\windows\\s ystem32\\krnl38 6.exe';return false;">Load krnl386.exe</a>
<!-- the above alerts "Error: -1" (Windows XP) -->
[color=blue]
> b) Test whether 'writes' are successful, by checking a file size
> before and after a write attempt.[/color]

As long as you attempt to write an actual image. And even if that succeeds,
there is no guarantee writing another type of file (or overwrite an existing
file) will work. Of course, if your script can write a file to the local file
system in the first place, I think the fact that you can read it's size is
probably much, much less of a security issue.
[color=blue]
> The other 4,326 are left as an exercise for the reader.[/color]

I'm not going to argue that something I haven't thought can't possibly be a
security issue. However, being able to retrieve the size of a file on the
local file system is not, in my mind, that large of a security issue (although
it probably shouldn't be allowed).

--
Grant Wagner <gwagner@agrico reunited.com>
comp.lang.javas cript FAQ - http://jibbering.com/faq

[Kevin Freitas]

Re: Syntax - Mozilla

So, for those of us in search of a way to make this happen, I offer up a
comparison: How does the "Page Info" feature in Moz/Firefox read the
page and media file sizes? I'd like to write an extension that uses this
info to provide an actual total page size.

Cheers! ~ Kevin

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[Grant Wagner]

Re: Syntax - Mozilla

Kevin Freitas wrote:
[color=blue]
> So, for those of us in search of a way to make this happen, I offer up a
> comparison: How does the "Page Info" feature in Moz/Firefox read the
> page and media file sizes? I'd like to write an extension that uses this
> info to provide an actual total page size.[/color]

An extension does not run in the sandbox provided to protect the system from
client-side JavaScript downloaded from untrusted Internet sites, it runs in
the context of a "trusted zone" where it can do anything (including writing
to the local file system).

This is equivilent to running a script in the "Local Computer zone" (and in
Windows XP Service Pack 2 agreeing to let the dynamic content load) and
using the FileSystem Object ActiveX control to manipulate the file system.

As for the requested task (determining the total page size in Gecko-based
browsers), this can not be done by a client-side JavaScript downloaded from
an untrusted Internet site in the default security environment.

--
Grant Wagner <gwagner@agrico reunited.com>
comp.lang.javas cript FAQ - http://jibbering.com/faq