Mozilla Aims At Cross-Site Scripting With FF3

Web 2.0 has enabled a broad array of Websites to be more engaging for users. It has also enabled a new and now very common attack, namely cross site scripting, commonly referred to as XSS attacks (define).

Mozilla is aiming to put an end to XSS attacks in its upcoming Firefox 3 browser. The Alpha 7 development release includes support for a new W3C working draft specification that is intended is secure XML over HTTP requests (often referred to as XHR) which are often the culprit when it comes to XSS attacks. XHR is the backbone of Web 2.0 enabling a more dynamic web experience with remote data.

"Cross site XMLHttpRequest will enable web authors to more easily and safely create Web mashups," Mike Schroepfer, Mozilla's vice president of engineering, told internetnews.com.

"It is one of many advanced Web standards that we are implementing in Firefox 3 and look forward to the world adopting."

The W3C working draft is officially titled, "Enabling Read Access for Web Resources." It's intended to define a mechanism by which Web developers can safely provide cross-site Web resource access. The specification will let developers define via an HTTP header or an XML instruction which sites are allowed read-access and which are not.

A typical XSS attack vector is one in which a malicious Web site reads the credentials from another that a user has visited. The new specification could well serve to limit that type of attack though it is still incumbent upon Web developers to be careful with their trusted data.

The W3C working draft warns that "user agents which implement this specification should take care not to expose other trusted data (cookies, HTTP header data) inappropriately."

Of course, it's also wise to consider the source.

"Application authors should be aware that content retrieved from another site is not itself trustable," the W3C working draft advises. "Authors should take care to protect against exposing themselves to cross-site scripting attacks by rendering or executing the retrieved content directly without validation."

In addition to the new XSS support in Firefox 3 Alpha 7, Mozilla developers have also fixed some bugs and implementation errors that cropped up in the Alpha 6 release, which came out in early July.

The latest release isn't just about bug fixes and new feature support. Mozilla developers have actually dropped support for the SOAP (define) Web services messaging protocol, according to the official Alpha 7 release notes. (It still runs in Firefox 3, however.)

"The SOAP implementation dropped from Firefox 3 was only available to extension authors, who have many other more modern implementations to choose from," Schroepfer explained. "We are, in general, removing as much old code from the core browser as possible to improve security, reduce download size, and allow Web and extension authors to choose the latest support libraries they need."

Firefox 3 is Mozilla's next generation browser and will be the successor to the current 2.x browser. The open source group has been working on Firefox 3 (code name Gran Paradiso) since October of 2006 when the first Firefox 3 alpha appeared.

At the time the Alpha 6 browser was released, Mozilla had projected that the Beta 1 release would be out by July 31. That obviously didn't happen.

"A firm date for Beta 1 has not yet been set," Schroepfer said. "We are shipping milestones every 6 weeks (next up is Milestone 8) and when the quality of the milestones are ready for broad use we'll ship Beta1."

Firefox Campus Edition Features Bundled Tools For Students

Continuing its string of branded versions of Firefox, Mozilla is set to release a “Campus Edition” aimed at students headed back to school. Firefox Campus is a little different that the previous branded versions we’ve covered (notably AllPeers and EBay) in that there’s no specific company involved, rather the campus edition of Firefox comes bundled with a number of add-ons students might find helpful.

The featured add-on in the campus edition are Zotero, FoxyTunes and StumbleUpon. Zotero is a research tool which helps collect, manage and cite research sources, while FoxyTunes lets you control various media players from within Firefox.

The StumbleUpon toolbar seems of dubious usefulness for students, though it is no doubt an excellent time waster and a fun way to find random, engaging websites.

The campus edition page should be available for download sometime later today.

While the student bundle is primarily a PR move on Mozilla’s part, and a good one at that, we can’t help thinking they left out some of the more useful plugins for students.

For instance, Research Word gives Firefox a handy contextual menu item to look up words and phrases in a variety of sources. Select the word to lookup and right-click the selection to access definitions from Wikipedia, Google Definitions, IMDb and more.

For the science majors there’s Biotech, which offers some links and tools for people wanting to research the field of Biotechnology.

Other cool tools for students include Diigo, a web highlighter and sticky note extension and the Sirsi Library System add-on, which is a great time saver if your university or school uses the Sirsi Library System.