Rick Welykochy wrote: > Jim Donovan wrote: > > >GET /documents/url(data:image > > At a glance, this is a request for a data: URI > <http://en.wikipedia.org/wiki/Data_URI_scheme> > > There are exploits involving this rarely used URI scheme. > <http://www.google.com.au/search?q=data+uri+exploit>
I'd guess this isn't an exploit. The image encoded in that URI is just a couple of little icons: "?", "-", "x" and a Google search "g" (i.e. it looks like a CSS sprite encoded in a data: URI). Also, the user agent string includes "GTB": Google Toolbar. I suspect a bug in Google Toolbar, at least in that version or combination with IE 8, that is accidentally causing a data: URI to be treated a relative HTTP URI. In short: it looks like a harmless bug in one user's browser. -Andrew. -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
