3 ms·

You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page

by dylz 6y ago

You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.

zaroth 6y ago
I think the point is that you go to the site, and save the HTML on your local machine, and then run it from there. It would be amazing if there was a property you could add to the <html> tag to enforce that the browser would prevent any network access or disk writes. As it stands I think after you save the files, you would have to look into each .js file downloaded as part of the bundle to check for outgoing network requests? The code is tiny except for vue_debug.js which is 193KB.
- deleted 6y ago
  [deleted]
- ahazred8ta 6y ago
  > save the HTML on your local machine, and then run it from there Yes; there is another js Shamir utility that works like that; it requires you to download the html and refuses to run unless it detects that you are offline. :-) https://bs.parity.io/#-BananaSplit-shamir https://bs.parity.io/#-BananaSplit-shamir
  - ijpsud 6y ago
    > refuses to run unless it detects that you are offline They could just display the "please disconnect" error for a while, then sneakily stop checking after some date, collecting data every time you forget to disconnect. You'd need to check the code, or never forget to disconnect - the latter is probably a mistake waiting to happen. Chrome bug page for "offline-only PWAs" if you want to star it: https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236
blitmap 6y ago
Are you saying JS could modify the CSP policy or meta tag after page load? Suddenly I'm thinking it would be very cool to be able to right-click on a tab and say 'Take Tab Offline' Imagine if it was like a toggle on the tab itself like muting sound from a tab. It would instruct the browser to isolate the tab/process from the network? I'm not sure how Web Workers play into this.
- dylz 6y ago
  You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.
  - blitmap 6y ago
    I mean you could absolutely inspect the source for the page, but these things could be modified at runtime by JS, right? I'm talking about the meta tags. It would be neat to have a toggle on the tab for isolating the content of the page from the network.
    - ijpsud 6y ago
      You'd have to restrict localstorage and stuff like that too, else they could save data and then send it when they regain network access. If you have a use-case, or some ideas, there's Chrome bug page for "offline-only PWAs": https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236

by dylz 6y ago

You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.

zaroth 6y ago

I think the point is that you go to the site, and save the HTML on your local machine, and then run it from there. It would be amazing if there was a property you could add to the <html> tag to enforce that the browser would prevent any network access or disk writes. As it stands I think after you save the files, you would have to look into each .js file downloaded as part of the bundle to check for outgoing network requests? The code is tiny except for vue_debug.js which is 193KB.

deleted 6y ago
[deleted]
ahazred8ta 6y ago
> save the HTML on your local machine, and then run it from there Yes; there is another js Shamir utility that works like that; it requires you to download the html and refuses to run unless it detects that you are offline. :-) https://bs.parity.io/#-BananaSplit-shamir https://bs.parity.io/#-BananaSplit-shamir
- ijpsud 6y ago
  > refuses to run unless it detects that you are offline They could just display the "please disconnect" error for a while, then sneakily stop checking after some date, collecting data every time you forget to disconnect. You'd need to check the code, or never forget to disconnect - the latter is probably a mistake waiting to happen. Chrome bug page for "offline-only PWAs" if you want to star it: https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236

blitmap 6y ago

Are you saying JS could modify the CSP policy or meta tag after page load? Suddenly I'm thinking it would be very cool to be able to right-click on a tab and say 'Take Tab Offline' Imagine if it was like a toggle on the tab itself like muting sound from a tab. It would instruct the browser to isolate the tab/process from the network? I'm not sure how Web Workers play into this.

dylz 6y ago
You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.
- blitmap 6y ago
  I mean you could absolutely inspect the source for the page, but these things could be modified at runtime by JS, right? I'm talking about the meta tags. It would be neat to have a toggle on the tab for isolating the content of the page from the network.
  - ijpsud 6y ago
    You'd have to restrict localstorage and stuff like that too, else they could save data and then send it when they regain network access. If you have a use-case, or some ideas, there's Chrome bug page for "offline-only PWAs": https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236