4 ms·

Wow, you could embed entire videos with the data: uri, or run entire web apps with inline javascript with Lotus Notes if they don't sanitize it. Or completely b

by vortico 11y ago

Wow, you could embed entire videos with the data: uri, or run entire web apps with inline javascript with Lotus Notes if they don't sanitize it. Or completely breach their privacy by scanning their LAN for webcam URLs or taking screenshots with WebGL textures using Nvidia driver bugs... nods off and dreams

tehlike 11y ago
Isn't that something any website can do right now?
- vortico 11y ago
  I don't know if you can take advantage of the random Nvidia texture leak in Linux with WebGL (I've seen it done with OpenGL), but yes. Internet users typically need to have at least some trust in the sites they visit because indeed, bad sites can do bad things to your privacy.
mschuster91 11y ago
No, that doesn't work with proper sandbox attribute. To quote w3schools (http://www.w3schools.com/tags/att_iframe_sandbox.asp http://www.w3schools.com/tags/att_iframe_sandbox.asp): When the sandbox attribute is present, and it will: * treat the content as being from a unique origin * block form submission * block script execution * disable APIs * prevent links from targeting other browsing contexts * prevent content from using plugins (through <embed>, <object>, <applet>, or other) * prevent the content to navigate its top-level browsing context * block automatically triggered features (such as automatically playing a video or automatically focusing a form control) I'd say alone blocking scripts, form submits, preventing links to change other contents and checking if there's behavior stuff in the CSS (which facilitates Javascript injection) is enough to have a secure webmail display. Responsive webmails \o/
- vortico 11y ago
  Interesting, I wasn't aware of this.
- Pxtl 11y ago
  Oh man, that is a dream. I had no idea that this was a thing. Too bad iframes themselves are kind of tricky to size correctly or I'd be using this willy-nilly. Skip sanitizing HTML and use a full sandboxed HTML iFrame for every comment on a user forum!
  - mschuster91 11y ago
    > Too bad iframes themselves are kind of tricky to size correctly You could use an injected JS (postMessage with the iframe window height) and update the iframe height from the outside. And for the content you should just strip any script tags so you can safely allow scripting. You should strip script tags in any case so that someone cannot use an API call which outputs raw comments as a delivery vector. Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display.
    - Pxtl 11y ago
      > Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display. An evil part of me considers that a feature, not a bug. And as for stripping script tags, I'm always reminded of this story: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl...
- JoBrad 11y ago
  Does this prevent a page from positioning an element over another element, outside of its frame?

by vortico 11y ago

tehlike 11y ago

Isn't that something any website can do right now?

vortico 11y ago
I don't know if you can take advantage of the random Nvidia texture leak in Linux with WebGL (I've seen it done with OpenGL), but yes. Internet users typically need to have at least some trust in the sites they visit because indeed, bad sites can do bad things to your privacy.

mschuster91 11y ago

No, that doesn't work with proper sandbox attribute. To quote w3schools (http://www.w3schools.com/tags/att_iframe_sandbox.asp http://www.w3schools.com/tags/att_iframe_sandbox.asp): When the sandbox attribute is present, and it will: * treat the content as being from a unique origin * block form submission * block script execution * disable APIs * prevent links from targeting other browsing contexts * prevent content from using plugins (through <embed>, <object>, <applet>, or other) * prevent the content to navigate its top-level browsing context * block automatically triggered features (such as automatically playing a video or automatically focusing a form control) I'd say alone blocking scripts, form submits, preventing links to change other contents and checking if there's behavior stuff in the CSS (which facilitates Javascript injection) is enough to have a secure webmail display. Responsive webmails \o/

vortico 11y ago
Interesting, I wasn't aware of this.
Pxtl 11y ago
Oh man, that is a dream. I had no idea that this was a thing. Too bad iframes themselves are kind of tricky to size correctly or I'd be using this willy-nilly. Skip sanitizing HTML and use a full sandboxed HTML iFrame for every comment on a user forum!
- mschuster91 11y ago
  > Too bad iframes themselves are kind of tricky to size correctly You could use an injected JS (postMessage with the iframe window height) and update the iframe height from the outside. And for the content you should just strip any script tags so you can safely allow scripting. You should strip script tags in any case so that someone cannot use an API call which outputs raw comments as a delivery vector. Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display.
  - Pxtl 11y ago
    > Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display. An evil part of me considers that a feature, not a bug. And as for stripping script tags, I'm always reminded of this story: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl...
JoBrad 11y ago
Does this prevent a page from positioning an element over another element, outside of its frame?