Skype browser addons injecting JS code...

... in FCKeditor

Hi,

i recently got this problem, since we have dynamic pages that users can update thrue FCKeditor, that if user has Skype toolbar instaled in browser, that thing injects like 200 lines JS script when you enter text thre FCK... since there is now arning or notice about that, this seems like hmmm posible exploit.

anyway, i am just wondering if anyone has expirienced that problem and if there is a way to stop that from FCK side since i can't realy stop that from user side?

Mon, 08/17/2009 - 22:04

tunedin

Joined: 17/08/2009

Posts: 10

Re: Skype browser addons injecting JS code...

Hmmm... Sorry I don't have an answer for this. I'm pretty sure I don't have the skype toolbar installed on my IE8 and I'm getting this stuff inserted in files that I edit with FCKeditor:

<script src="chrome://skype_ff_toolbar_win/content/injection_graph_func.js" id="injection_graph_func" charset="utf-8" type="text/javascript"></script>
<link id="injection_graph_css" rel="stylesheet" type="text/css" href="chrome://skype_ff_toolbar_win/content/injection_graph.css" charset="utf-8" /><script src="chrome://skype_ff_toolbar_win/content/injection_graph_func.js" id="injection_graph_func" charset="utf-8" type="text/javascript"></script><script src="chrome://skype_ff_toolbar_win/content/injection_graph_func.js" id="injection_graph_func" charset="utf-8" type="text/javascript"></script>

Fri, 08/21/2009 - 13:06

alfonsoml

Joined: 31/12/2006

Posts: 3737

Re: Skype browser addons injecting JS code...

You are getting that content inserted with IE8?

Are you sure that it isn't present before you start editing?

Or that you haven't been fooled to think that you are using IE8 but in reality you are using a Firefox tuned to look like IE8?

You can be sure that there's no code related to Skype in the source code of FCKeditor, so if you see it, then it's something in your computer.