Hacker News Reader

Comment by rosndo | Hacker News Reader

Worth mentioning that both w3m and lynx are horribly insecure. Although I guess it’s very unlikely that anyone would actually bother to exploit such niche software.

View on HN

Are they, despite not having most of the attack surface other browsers have (due to not supporting a lot of features)?

Yes. The problem is that the features which they do support (which are still plentiful) are not particularly well implemented.

Parsing HTML is difficult.

Do you know of any current vulnerabilities in w3m? The last one I saw was in 2010 and fixed. Is it just not studied enough and there could be many undiscovered vulnerabilities? Beings up an interesting question of how to evaluate unknown vulnerabilities to determine if something is horribly insecure.

It’s not studied because nobody cares about w3m or Lynx. I’m just making these statements based on my own experience with fuzzing both a few years ago.

> nobody cares about w3m or Lynx

I'd say, this is a security feature - even if the code is not the most secure.

Out of interest, did you report your findings from fuzzing? Did things got fixed?

Not that difficult if still laborious when following the construction of IETF HTML and W3C HTML 4.x as an SGML vocabulary ab initio which already covers the vast majority of what people coming from XML have problems understanding, such as tag inference eg automatically ending span-level markup on block-level content. Plus some irregularities introduced with URLs, and with CSS and JavaScript to prevent those from being displayed as content in old browsers. Then add some more oddities introduced with WHATWG HTML 5.1+ arguably by accident and due to ignorance and lack of a formal grammar.

They both parse untrusted content content without any sandboxing.

I typically send content through rdrview[0] before piping through w3m-sandbox[1], which should be pretty safe. I also only browse one site per w3m instance.

[0]: https://github.com/eafer/rdrview

[1]: https://git.sr.ht/~seirdy/bwrap-scripts/tree/trunk/item/w3m-...

Reply on news.ycombinator.com