6 ms·

I fail to see how this isn't ripe for abuse. I can execute javascript in a person's browser using your domain. http://tinyurl.com/y5m7o4j8 http://tinyurl.com/y

I fail to see how this isn't ripe for abuse. I can execute javascript in a person's browser using your domain. http://tinyurl.com/y5m7o4j8 http://tinyurl.com/y5m7o4j8

judge2020 7y ago
Likely going to be blocked everywhere like JSfiddle is: https://github.com/jsfiddle/jsfiddle-issues/issues/1417 https://github.com/jsfiddle/jsfiddle-issues/issues/1417 Only issue is this being deployed more widespread, Twitter may need to start scanning explicitly for this software to block it regardless of domain.
- lol768 7y ago
  I don't see how this issue is unique to jsfiddle or this project.. Any static hosting service is going to have this issue no?
  - aaronharnly 7y ago
    You can host each piece of content on its own subdomain, and within a sandboxed iframe from the rest of the site.
    - lol768 7y ago
      You could, but you'd probably break a lot of legitimate functionality.
the_pwner224 7y ago
How is this bad? If the domain is only used to host the decoder, what bad stuff can a bad guy do by executing JS? I get how this would be a vulnerability on Facebook, but why is it bad here?
- novaleaf 7y ago
  just off the top of my head, but a bad guy could distribute a "bugged" version of the url that installs cookies and phones home. very hard for a normal person to tell the good link from a bad link, and removes the way most people determine if a link should be trusted (by looking at the domain)
- zawerf 7y ago
  One example would be if they can trick the user into installing a service worker, then they can hijack all fetch calls for all other pages (I think).
  - stackola 7y ago
    That's not true, service workers still obey the cross-origin policy. The only thing I can think of is, that a service worker has it's own CSP, as opposed to obeying the CSP of the registering script, but this service doesn't use CSP anyways.
    - zawerf 7y ago
      I meant all the pages published using this tool which are all at the same scope of: https://jstrieb.github.io/urlpages/#blahblah https://jstrieb.github.io/urlpages/#blahblah That said I couldn't get it to work. You would need to be able to register a service worker file at something like https://jstrieb.github.io/urlpages/sw.js https://jstrieb.github.io/urlpages/sw.js but all the pages you have control over have proper html mime type and are rejected when you try to register them (and have too much actual html junk in them to run as js files anyway).
      - stackola 7y ago
        You don't even need a service worker for that. Just fetch it. fetch("https://jstrieb.github.io/") So yea, other sites on his github pages are compromised, that's true.
        7y ago
deleted 7y ago
[deleted]
hjk05 7y ago
You can do that with any hosting service...
Faark 7y ago
Yeah, you'd probably want to sign the content in the URL and verify the signature before displaying. Sound doable, if someone would actually take that idea serious...
- jstrieb 7y ago
  Added to the TODO section in the repo. I agree that it seems pretty doable to implement digital signatures, and similarly to support encrypting and password-protecting URL Pages. Since this has received more attention than I expected, I'd be willing to put the time in to implement this.
  - bb010g 7y ago
    Keybase might integrate well here, for signatures at least.
- Thorrez 7y ago
  What's the purpose of that? What attacks does it prevent?

I fail to see how this isn't ripe for abuse. I can execute javascript in a person's browser using your domain. http://tinyurl.com/y5m7o4j8 http://tinyurl.com/y5m7o4j8

judge2020 7y ago

Likely going to be blocked everywhere like JSfiddle is: https://github.com/jsfiddle/jsfiddle-issues/issues/1417 https://github.com/jsfiddle/jsfiddle-issues/issues/1417 Only issue is this being deployed more widespread, Twitter may need to start scanning explicitly for this software to block it regardless of domain.

lol768 7y ago
I don't see how this issue is unique to jsfiddle or this project.. Any static hosting service is going to have this issue no?
- aaronharnly 7y ago
  You can host each piece of content on its own subdomain, and within a sandboxed iframe from the rest of the site.
  - lol768 7y ago
    You could, but you'd probably break a lot of legitimate functionality.

the_pwner224 7y ago

How is this bad? If the domain is only used to host the decoder, what bad stuff can a bad guy do by executing JS? I get how this would be a vulnerability on Facebook, but why is it bad here?

novaleaf 7y ago
just off the top of my head, but a bad guy could distribute a "bugged" version of the url that installs cookies and phones home. very hard for a normal person to tell the good link from a bad link, and removes the way most people determine if a link should be trusted (by looking at the domain)
zawerf 7y ago
One example would be if they can trick the user into installing a service worker, then they can hijack all fetch calls for all other pages (I think).
- stackola 7y ago
  That's not true, service workers still obey the cross-origin policy. The only thing I can think of is, that a service worker has it's own CSP, as opposed to obeying the CSP of the registering script, but this service doesn't use CSP anyways.
  - zawerf 7y ago
    I meant all the pages published using this tool which are all at the same scope of: https://jstrieb.github.io/urlpages/#blahblah https://jstrieb.github.io/urlpages/#blahblah That said I couldn't get it to work. You would need to be able to register a service worker file at something like https://jstrieb.github.io/urlpages/sw.js https://jstrieb.github.io/urlpages/sw.js but all the pages you have control over have proper html mime type and are rejected when you try to register them (and have too much actual html junk in them to run as js files anyway).
    - stackola 7y ago
      You don't even need a service worker for that. Just fetch it. fetch("https://jstrieb.github.io/") So yea, other sites on his github pages are compromised, that's true.
      - 7y ago

deleted 7y ago

[deleted]

hjk05 7y ago

You can do that with any hosting service...

Faark 7y ago

Yeah, you'd probably want to sign the content in the URL and verify the signature before displaying. Sound doable, if someone would actually take that idea serious...

jstrieb 7y ago
Added to the TODO section in the repo. I agree that it seems pretty doable to implement digital signatures, and similarly to support encrypting and password-protecting URL Pages. Since this has received more attention than I expected, I'd be willing to put the time in to implement this.
- bb010g 7y ago
  Keybase might integrate well here, for signatures at least.
Thorrez 7y ago
What's the purpose of that? What attacks does it prevent?