Cross-zone Scripting - Origins of The Zone Concept

Origins of The Zone Concept

Internet Explorer 4 introduced a security zone concept into Internet Explorer. However, this is a generic issue which is not Internet Explorer specific; some other browsers also implicitly implement the Local Computer zone.

There are four well known zones in Internet Explorer:

  • Internet. The default zone. Everything which does not belong to other zones.
  • Local intranet.
  • Trusted sites. Usually used to list trusted sites which are allowed to execute with minimal security permissions (e.g. run unsafe and unsigned ActiveX objects).
  • Restricted sites.

These zones are explained in detail by Q174360: How to use security zones in Internet Explorer.

There is also an additional hidden zone:

  • Local Computer zone (or My Computer zone). This zone is particularly interesting because it can access files on the local computer. Historically this zone has been extremely insecure, but in recent versions Internet Explorer (for Windows XP) steps have been taken to reduce risks associated with zone.

Local intranet, Trusted sites and Local Computer are usually configured to be privileged zones. Most cross-zone scripting attacks are designed to jump from Internet zone to a privileged zone.

Read more about this topic:  Cross-zone Scripting

Famous quotes containing the words origins of, origins, zone and/or concept:

    Compare the history of the novel to that of rock ‘n’ roll. Both started out a minority taste, became a mass taste, and then splintered into several subgenres. Both have been the typical cultural expressions of classes and epochs. Both started out aggressively fighting for their share of attention, novels attacking the drama, the tract, and the poem, rock attacking jazz and pop and rolling over classical music.
    W. T. Lhamon, U.S. educator, critic. “Material Differences,” Deliberate Speed: The Origins of a Cultural Style in the American 1950s, Smithsonian (1990)

    Lucretius
    Sings his great theory of natural origins and of wise conduct; Plato
    smiling carves dreams, bright cells
    Of incorruptible wax to hive the Greek honey.
    Robinson Jeffers (1887–1962)

    In the zone of perdition where my youth went as if to complete its education, one would have said that the portents of an imminent collapse of the whole edifice of civilization had made an appointment.
    Guy Debord (b. 1931)

    The concept of a person is logically prior to that of an individual consciousness. The concept of a person is not to be analysed as that of an animated body or an embodied anima.
    Sir Peter Frederick Strawson (b. 1919)