3 ms·
These are awesome finds, but also pretty troubling lack of care on both Microsoft and Chrome. 1. Why don't chrome:// pages have at least basic CSP setup to mit
by spaceribs 7y ago
These are awesome finds, but also pretty troubling lack of care on both Microsoft and Chrome.
1. Why don't chrome:// pages have at least basic CSP setup to mitigate XSS?
2. Why isn't Microsoft using some sort of framework which abstracts them from direct DOM access?
- Lammy 7y agoRE: #1, I think it’s probably just one of those assumptions that passes over our collective heads until we have a wake-up call, like the need for TLS over leased fiber in the wake of the PRISM/MUSCULAR revelations. I could totally see a hypothetical “chain of changes” that lead to something like a lack of exploit mitigations on internal/preference pages. Those kind of interfaces used to be implemented with native OS GUI controls (or some facsimile like XUL), and I assume the collective thinking toward their security didn’t get rethought much when Chrome et al implemented them with web controls. Considering I’m here commenting about it and not discovering this myself just makes me thankful these things get found at all :)
- londons_explore 7y agochrome:// pages do. But Microsoft didn't use a chrome:// URL, they instead gave the privileges to an https:// https:// URL, breaking the security model.
- spaceribs 7y agoAh, thanks for that info! The article made it seem like the entire implementation was done within chrome://