Re: How should the image widget work?

On Wed, 19 Jan 2005, Phil wrote:

> The biggest obstacle I can see to server-side image rendering is that it
> would be relatively easy for us (or of course the libMagick crew) to
> introduce a bug which allowed one client to alter the image resources of
> another.  This would be a big security problem (as you could
> misrepresent data), and would be less likely to crop up if we had a
> simpler server-side widget and put the complexity in the client.  The
> recent(ish) JPEG-rendering-related security holes in a lot of software
> show how easy it is for this kind of thing to creep in.

X, as it currently stands, lets any application with the window id of
another window draw directly into that window.  There have been murmurs of
fixing this in the last couple of years [1].

> I'm not suggesting we're more likely to introduce security holes than
> anyone else, just that we're no less likely to do so.
>
> A compromise would be to use the server-side widget if the uid of the
> client process matches the uid of the server process, that should at
> least stop malicious images interfering with privileged programs.

What about clients on remote machines?  To disallow them access to the
server-side widgetry will negate their greatest benefit.

Regards,

  Mark.

[1] http://www.nsa.gov/selinux/papers/X11_Study.pdf
-- 
|| Mark Thomas
|| efaref.net
||
|| Give me ambiguity or give me something else.