3 ms·

This works by executing Javascript code written by the user. Since these notebooks are shareable, and there is also a log-in feature, do any security features n

by rntz 9y ago

This works by executing Javascript code written by the user. Since these notebooks are shareable, and there is also a log-in feature, do any security features need to be put in place to prevent, say, someone linking me to a notebook that sends my login credentials for observablehq.com to a malicious host? That is, is the javascript inside the notebook sandboxed in any way? I don't fully understand how modern web security works. But "executing arbitrary javascript written by user A on website B viewed by user C" seems worrying.

tmcw 9y ago
Sure, happy to share a few of the gory details. Yep, Observable runs user JavaScript code, but that code has no access to your login credentials or anything from the 'application': user code runs in a sandboxed iframe on a separate host - host that doesn't have any cookies or user information. The application communicates with that iframe host through serialized postMessage information only. That's the gist of the 'user code' portion - the rest of the application has additional layers of best-practice security like very strict content security policies and so on that defend from other kinds of attacks.
jashkenas 9y ago
Yes. We use <iframe>s with the sandbox attribute (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...) to uh ... sandbox away the running JavaScript. If you inspect them, you'll see that those frames are hosted on observableusercontent.com instead of observablehq.com. It's a similar security model to how raw files on GitHub are served from githubusercontent.com.
- ontouchstart 9y ago
  I wrote a simple notebook: https://beta.observablehq.com/@ontouchstart/test https://beta.observablehq.com/@ontouchstart/test to confirm that the code is running in an iframe from host https://static.observableusercontent.com https://static.observableusercontent.com

by rntz 9y ago

tmcw 9y ago

Sure, happy to share a few of the gory details. Yep, Observable runs user JavaScript code, but that code has no access to your login credentials or anything from the 'application': user code runs in a sandboxed iframe on a separate host - host that doesn't have any cookies or user information. The application communicates with that iframe host through serialized postMessage information only. That's the gist of the 'user code' portion - the rest of the application has additional layers of best-practice security like very strict content security policies and so on that defend from other kinds of attacks.

jashkenas 9y ago

Yes. We use <iframe>s with the sandbox attribute (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...) to uh ... sandbox away the running JavaScript. If you inspect them, you'll see that those frames are hosted on observableusercontent.com instead of observablehq.com. It's a similar security model to how raw files on GitHub are served from githubusercontent.com.

ontouchstart 9y ago
I wrote a simple notebook: https://beta.observablehq.com/@ontouchstart/test https://beta.observablehq.com/@ontouchstart/test to confirm that the code is running in an iframe from host https://static.observableusercontent.com https://static.observableusercontent.com