3 ms·

Just a general question but were there any unexpected vulnerabilities discovered through developing these tools? I haven't taken a look into the code but from t

by zengid 9y ago

Just a general question but were there any unexpected vulnerabilities discovered through developing these tools? I haven't taken a look into the code but from the descriptions of the limitations with iframes and cross-domain windows it seems like your having to hack around the barriers and venture into unsettled territory.

bluepnume 9y ago
We didn't discover any new real browser vulnerabilities, thankfully -- mainly just browser's being overly protective in some cases. Most of the hacks were just to get IE up-to-par with the other browsers. For example, to send a postMessage between a popup and the parent page, the only way is to place a hidden iframe on the parent page, with the same domain as the popup. post-robot abstracts most of that away. The line we had to walk in terms of security was, on top of not introducing any new vulnerabilities ourselves, making sure we didn't make it too easy for people to accidentally introduce any security loopholes using what we've built. For example -- the idea of passing a function over to a different window is a fairly novel concept. The idea is, if you want to give the other window control over something, say to log out a user, you can just pass a `user.logout` function directly in a message to the target window. But then there's a risk people will absentmindedly pass functions in messages that they didn't expect to. But then, on top of that, there's a lot we can do automatically to protect users, that doesn't happen automatically with regular browser apis. For example, if you render an xcomponent with a certain url, xcomponent will (by default) ensure that only messages from that domain are allowed up from the iframe. Which is something you'd need to remember to do manually if you were just listening for post-messages.

3 ms·

Just a general question but were there any unexpected vulnerabilities discovered through developing these tools? I haven't taken a look into the code but from t

by zengid 9y ago

bluepnume 9y ago
We didn't discover any new real browser vulnerabilities, thankfully -- mainly just browser's being overly protective in some cases. Most of the hacks were just to get IE up-to-par with the other browsers. For example, to send a postMessage between a popup and the parent page, the only way is to place a hidden iframe on the parent page, with the same domain as the popup. post-robot abstracts most of that away. The line we had to walk in terms of security was, on top of not introducing any new vulnerabilities ourselves, making sure we didn't make it too easy for people to accidentally introduce any security loopholes using what we've built. For example -- the idea of passing a function over to a different window is a fairly novel concept. The idea is, if you want to give the other window control over something, say to log out a user, you can just pass a `user.logout` function directly in a message to the target window. But then there's a risk people will absentmindedly pass functions in messages that they didn't expect to. But then, on top of that, there's a lot we can do automatically to protect users, that doesn't happen automatically with regular browser apis. For example, if you render an xcomponent with a certain url, xcomponent will (by default) ensure that only messages from that domain are allowed up from the iframe. Which is something you'd need to remember to do manually if you were just listening for post-messages.