From why at hobix.com Fri Sep 2 14:57:32 2005 From: why at hobix.com (why the lucky stiff) Date: Fri Sep 2 14:50:44 2005 Subject: ! MouseHole 1.1 released Message-ID: <4318A09C.1040906@hobix.com> A walkthrough: http://redhanded.hobix.com/inspect/mousehole11InPlainView.html Links from the bottom: * Download MouseHole 1.1: o Windows standalone. (No Ruby required.) o or Source zip. (Ruby, yaml, dbm, rexml libraries required.) o or Source tarball. (Ruby, yaml, dbm, rexml libraries required.) * My own MouseHole scripts. * The MouseHole wiki. * Mailing list is mousehole-scripters _why -------------- next part -------------- An HTML attachment was scrubbed... URL: http://rubyforge.org/pipermail/mousehole-scripters/attachments/20050902/14752696/attachment.htm From jake at bitmechanic.com Sat Sep 3 23:11:09 2005 From: jake at bitmechanic.com (Jake Donham) Date: Sat Sep 3 22:59:47 2005 Subject: wikish Message-ID: <200509040311.j843BAmv006373@sparkplug.bitmechanic.com> Hi, A couple hours' hack: a wiki (based on why's) with a "run" action which runs the page as Ruby code: http://jaked.org/wikish.user.rb (You shouldn't put this on a MouseHole that is publically accessible, since it has no protection of any kind at the moment.) The idea is that it is a web-based shell like YubNub, but you can execute arbitrary code. There is no input form at the moment--I'm using it by setting keyword.URL to http://127.0.0.1:37004/wikish/run/ from about:config in Firefox so I can type commands at the URL bar. This doesn't have anything particularly to do with proxying (neither does why's wiki) but if you are already running a personal server, that seems like the right place to put it. So far I haven't done anything except redirections. Here are a few: del: (change username to taste) response['location'] = "http://del.icio.us/jaked/#{args.join('+')}" raise WEBrick::HTTPStatus::Found amaz: response['location'] = "http://www.amazon.com/exec/obidos/external-search?mode=blended&field-keywords=#{args.join('+')}" raise WEBrick::HTTPStatus::Found edit: (so you can say e.g. "edit amaz") response['location'] = "http://127.0.0.1:37004/wikish/edit/#{args[0]}" raise WEBrick::HTTPStatus::Found Some ideas for the future: security more shell syntax--variables, pipes? or more ruby-ish? see scsh call code on a wiki page from another page's code--wiki page defines a subroutine OS auth so you can look at your files etc wiki-ish editing of OS files other web interfaces to things on the OS commands to control MouseHole--enable/disable scripts etc. forward commands to a different wikish or to an OS command shell convenience methods for things like redirections Jake From why at hobix.com Mon Sep 5 02:09:29 2005 From: why at hobix.com (why the lucky stiff) Date: Sun Sep 4 02:03:13 2005 Subject: ! MouseHole 1.1 Windows Installer Message-ID: <431BE119.1030502@hobix.com> Okay, I've got an installer up for Windows now. I'm also working on a generic gem, a win32 gem and a mac osx dmg installer. Once I've got Rake building all of these, we'll have a good smorgasbord of possible installers to give everyone their options. _why From why at hobix.com Mon Sep 5 02:19:00 2005 From: why at hobix.com (why the lucky stiff) Date: Sun Sep 4 02:12:37 2005 Subject: wikish In-Reply-To: <200509040311.j843BAmv006373@sparkplug.bitmechanic.com> References: <200509040311.j843BAmv006373@sparkplug.bitmechanic.com> Message-ID: <431BE354.1020503@hobix.com> Jake Donham wrote: >The idea is that it is a web-based shell like YubNub, but you can >execute arbitrary code. There is no input form at the moment--I'm using >it by setting keyword.URL to http://127.0.0.1:37004/wikish/run/ from >about:config in Firefox so I can type commands at the URL bar. > Incredibly cool idea! People are going to love this. The cool thing about having a wiki behind it: all your commands are versioned and attributed. This makes me wonder if the wiki's internals should be distilled and built into MouseHole's API. You don't need RedCloth support I guess. _why From why at hobix.com Mon Sep 5 02:31:33 2005 From: why at hobix.com (why the lucky stiff) Date: Sun Sep 4 02:25:09 2005 Subject: Security concerns Message-ID: <431BE645.10408@hobix.com> I'm really concerned about MouseHole's security. To a degree, user scripts are inherently granted permissions and open the user to attack (just as a downloaded executable can do any damage it pleases.) Anyway, here are the security concerns that need to be addressed: * Installed user scripts: are they allowed to do anything at all once the user has authorized installation? Or should they be forced to state their intentions? "Hi, I require at least $SAFE = 2!" * Uninstalled user scripts which are loaded for metadata scanning: are allowed to do nothing at all! * Javascript access to MouseHole: A MouseHole script injects Javascript into a page and that Javascript needs to store data back inside MouseHole. Uhh, this exposes MouseHole to possible attack from other Javascripts. What APIs do we allow Javascript to access. (You don't want a rogue Javascript deactivating all your scripts or wiping out your configurations, right?) * Javascript cross-site access: A MouseHole script injects Javascript into a page and that Javascript needs to pass data to another domain (normally a JS failure.) ** So, if we're on boingboing and we want to access metafilter.. http://boingboing.net/http://metafilter.com/api/post. That opens a security hole (the same one Greasemonkey just bumped up on.) ** Instead, we could have the MouseHole script register URLs before hand: register_url("http://metafilter.com/api/post") ** Then, the script is given a hash to access that domain. (Or is allowed access to it through http://boingboing.net/http://metafilter.com/api/post.) ** Or, just a whitelist with regexps. I'm sure there are other security issues. We'll start with these, though. _why From kevin at sb.org Sun Sep 4 05:11:54 2005 From: kevin at sb.org (Kevin Ballard) Date: Sun Sep 4 05:05:08 2005 Subject: New filtering in MouseHole Message-ID: <1A8FD71D-047A-47DF-AA8E-436FA515E1BD@sb.org> Ok, I've hacked on MouseHole a bit to make it possible for JavaScript to have access to MouseHole. I've done it in a fairly restrictive manner. Basically, I've made it possible for a script to handle any URL whose path starts with /.mouseHole/, matching based on domain and path. Because of naming issues, I decided to rename rewrite to filter and call this new feature rewrite (after all, the existing rewrite is really just filtering). But to preserve compatibility I've made rewrite with no args act like the new filter. How you use the new feature is you simply add a call to rewrite(). It takes 2 args. The first is a regex to match against host:port, so you might use /^(www\.)?google\.com:80/ to match against google. The second is a regex to match against the path after /.mouseHole/, so to match http://www.google.com/.mouseHole/ping you would use %r{^/ping $}. On a request to the proxy, if the request method is GET/POST/PUT/ HEAD and the path starts with /.mouseHole/, it will match against all existing rewriting, and the first one it finds that works it calls. The rewrite block should set both req['Content-Type'] and req.body to appropriate values. req['Content-Length'] will be filled in for you based on req.body. The scripts are matched in whatever order each_fresh_script uses and the individual rewrites will be matched in order of definition. I would recommend that the path match be something fairly unique, so multiple generic scripts (i.e. ones not limited to a specific domain) don't try to use the same path. I thought about sticking a script identifier into the matched path, but I wasn't sure what to use. The reason I restricted the rewriting to /.mouseHole/ is because it makes writing scripts a bit easier (so you don't end up trying to rewrite way too many pages when you meant to rewrite a specific page) and faster (because it doesn't have to match all scripts for every request). Also because this feature is meant primarily for JavaScript XMLHttpRequest calls, although you could use this to toss in a