3 ms·
Oh man, that is a dream. I had no idea that this was a thing. Too bad iframes themselves are kind of tricky to size correctly or I'd be using this willy-nilly
by Pxtl 11y ago
Oh man, that is a dream. I had no idea that this was a thing. Too bad iframes themselves are kind of tricky to size correctly or I'd be using this willy-nilly. Skip sanitizing HTML and use a full sandboxed HTML iFrame for every comment on a user forum!
- mschuster91 11y ago> Too bad iframes themselves are kind of tricky to size correctly You could use an injected JS (postMessage with the iframe window height) and update the iframe height from the outside. And for the content you should just strip any script tags so you can safely allow scripting. You should strip script tags in any case so that someone cannot use an API call which outputs raw comments as a delivery vector. Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display.
- Pxtl 11y ago> Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display. An evil part of me considers that a feature, not a bug. And as for stripping script tags, I'm always reminded of this story: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl...