please, i encourage you to help smoothening out my trial-and-error-style coding. other than that, the premise and functionality is same, just copy it from below, it should preserve the lines, et al. though it's a mess (and i'm not sed & awk guru, apparently) because i had to format the lines and strip some junk from Camino's XML bookmark file first. Thanks! i tried to recreate the same for my browser of choice, Camino. Sorry, I don't see anything overly dangerous here. If an attacker were able to manipulate the user's system so that the "uuidgen" command ran something other than Apple's /usr/bin/uuidgen.Īnd if either of these scenarios is possible, you already have bigger problems than this script could expose you to. This threat can be avoided by using a more specific "find" location, as has already been mentioned in one of the replies here. If an attacker were somehow able to cause files to be created in the user's home directory so that the "find" command returns the wrong file. None of these items are ever exposed to a command line, either directly or by output within a backtick construct- the only things in backticks are the "find" command which locates Firefox's bookmarks.html file, and the word "uuidgen" which is a command to generate UUID numbers which are used as unique filenames. the dangerous items, the items which could potentially be controlled by the operator of a malicious web site, are the URL, the page title, and the icon. considering it's suggested to run it every 10 minutes.)
Ex: find ~/Library/Application\ Support/Firefox/Profiles/ -name 'bookmarks.html'If your home is quite large, you'll notice a bit of chugging while looking for stuff in the authour's version (esp. As far as I know, Firefox keeps it's stuff in a known location. Aborting.Īlso, the 'find' command can be a little more precise. mdimport Expected bookmark file to be a CFDictionary bu it isn't. Maybe somebody could confirm this, though? Not a problem though, since there's no need to index these and the real bookmarks got in just fine.
I suspect this is being triggered by your pattern matching having an issue with all the (un)escaping that typically goes on in javascript bookmarklets.
While testing, I noticed that I couldn't see results immediately without manually running mdimport on the new Firefox metadata directory, as: mdimport ~/Library/Caches/Metadata/Firefox/Perhaps this might be useful in the script?ĭoing so produced several errors, but the number of errors appears to correspond to the number of "bookmarklet" bookmarks I have.
0 kommentar(er)
