5 ms·

There should be an HTML <remote> tag or something that downloads and embeds HTML from a remote site without scripting

by jdrc 5y ago

moonchild 5y ago
Don't [i]frames solve this problem? They can use scripts, sure, but those scripts are contained and cannot reach outside their box.
- robin_reala 5y ago
  A quick sandbox attribute and the scripts will be disabled: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...
saagarjha 5y ago
Ok, but then Twitter is just going to make that return a 404. How does this solve the problem?
- jdrc 5y ago
  why would they?
  - saagarjha 5y ago
    Because you're requesting a resource from them, and they consider that resource to be deleted?
    - 0des 5y ago
      Are you asking or telling, I'm prepared to answer if asking.
    - deleted 5y ago
      [deleted]
    - jdrc 5y ago
      i was responding re/ security and privacy. showing that the tweet is deleted would be expected behavior
- cxr 5y ago
  The behavior of the object element is to use its child nodes as fallback content in the event that the resource cannot be loaded, similar to the the treatment of images' alt attributes for images that fail to load. This isn't to say that this protects against a determined adversary (who might then chose not to return HTTP 404/410 and instead HTTP 200), but the mechanism is there.
fswd 5y ago
https://developer.mozilla.org/en-US/docs/Web/HTML/Element#embedded_content https://developer.mozilla.org/en-US/docs/Web/HTML/Element#em... <object> or <portal> already exist. maybe they would work?
- lol768 5y ago
  <portal> is an experiment/pet project pushed (and only implemented!) by one browser vendor, which as far as I know remains feature flagged. It was shipped behind a flag with an initial implementation vulnerable to a same origin policy bypass as well as local file disclosure. As far as I can tell the only reason it wasn't assigned a Moz standards position of "harmful" is because Google argued "it's actually still a work in progress!" (three years ago). Refs: - https://research.securitum.com/security-analysis-of-portal-element/ https://research.securitum.com/security-analysis-of-portal-e... - https://github.com/mozilla/standards-positions/issues/157 https://github.com/mozilla/standards-positions/issues/157
manigandham 5y ago
That's exactly what an <iframe> is.
- jdrc 5y ago
  iframe is loading a whole page with script permissions (and sandboxed). it seems there isnt any tag for adding a remote snippet of html, like you can do with ajax
  - cxr 5y ago
    What do you mean by "remote snippet of html"? An iframe loads whatever's on the other end of the src URL. If that's a "whole page", then it loads a whole page. If it's just a "snippet" of content, then it loads that. Any snippet you think of can be loaded by iframe exactly as described. The only hitch, really, is that it's always treated as block-level content instead of CSS-style "inline" flow-level content, but that's clearly not relevant to the use case at hand—embedded tweets are already block-level. It's not clear what you're asking for. (E.g. do you want that snippet not to be sandboxed?)
    - jdrc 5y ago
      iframe is a full page. i mean some HTML code, a div or some text or a table etc. the kind of things we load with Ajax. The equivalent of <img>, but for HTML content : <remotehtml src="https://twitter.com/snip/12345678 https://twitter.com/snip/12345678" />
      - cxr 5y ago
        This isn't really any clearer than your earlier comment. > iframe is a full page. An iframe loads whatever you give it. If you give it a URL to a "full page"/"whole page", then it loads that. If the URL leads to e.g. "a div" or "a table", then that will be loaded. That's under the control of the person who's putting stuff on the other end of the URL. To repeat, there is exactly one case where this doesn't hold up: when you want the loaded content to be inline and not block-level (e.g. "some text"—and if inline content is what you meant, then you should say that instead of just giving another vague response; again, though, even if that is what you want, how would that be relevant to the use case we're talking about here: embedding tweets?)
0des 5y ago
Guess I'll start on that exploit now, beat the crowd.

There should be an HTML <remote> tag or something that downloads and embeds HTML from a remote site without scripting

by jdrc 5y ago

There should be an HTML <remote> tag or something that downloads and embeds HTML from a remote site without scripting

Don't [i]frames solve this problem? They can use scripts, sure, but those scripts are contained and cannot reach outside their box.

robin_reala 5y ago
A quick sandbox attribute and the scripts will be disabled: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...

saagarjha 5y ago

Ok, but then Twitter is just going to make that return a 404. How does this solve the problem?

jdrc 5y ago
why would they?
- saagarjha 5y ago
  Because you're requesting a resource from them, and they consider that resource to be deleted?
  - 0des 5y ago
    Are you asking or telling, I'm prepared to answer if asking.
  - deleted 5y ago
    [deleted]
  - jdrc 5y ago
    i was responding re/ security and privacy. showing that the tweet is deleted would be expected behavior
cxr 5y ago
The behavior of the object element is to use its child nodes as fallback content in the event that the resource cannot be loaded, similar to the the treatment of images' alt attributes for images that fail to load. This isn't to say that this protects against a determined adversary (who might then chose not to return HTTP 404/410 and instead HTTP 200), but the mechanism is there.

fswd 5y ago

https://developer.mozilla.org/en-US/docs/Web/HTML/Element#embedded_content https://developer.mozilla.org/en-US/docs/Web/HTML/Element#em... <object> or <portal> already exist. maybe they would work?

lol768 5y ago
<portal> is an experiment/pet project pushed (and only implemented!) by one browser vendor, which as far as I know remains feature flagged. It was shipped behind a flag with an initial implementation vulnerable to a same origin policy bypass as well as local file disclosure. As far as I can tell the only reason it wasn't assigned a Moz standards position of "harmful" is because Google argued "it's actually still a work in progress!" (three years ago). Refs: - https://research.securitum.com/security-analysis-of-portal-element/ https://research.securitum.com/security-analysis-of-portal-e... - https://github.com/mozilla/standards-positions/issues/157 https://github.com/mozilla/standards-positions/issues/157

manigandham 5y ago

That's exactly what an <iframe> is.

jdrc 5y ago
iframe is loading a whole page with script permissions (and sandboxed). it seems there isnt any tag for adding a remote snippet of html, like you can do with ajax
- cxr 5y ago
  What do you mean by "remote snippet of html"? An iframe loads whatever's on the other end of the src URL. If that's a "whole page", then it loads a whole page. If it's just a "snippet" of content, then it loads that. Any snippet you think of can be loaded by iframe exactly as described. The only hitch, really, is that it's always treated as block-level content instead of CSS-style "inline" flow-level content, but that's clearly not relevant to the use case at hand—embedded tweets are already block-level. It's not clear what you're asking for. (E.g. do you want that snippet not to be sandboxed?)
  - jdrc 5y ago
    iframe is a full page. i mean some HTML code, a div or some text or a table etc. the kind of things we load with Ajax. The equivalent of <img>, but for HTML content : <remotehtml src="https://twitter.com/snip/12345678 https://twitter.com/snip/12345678" />
    - cxr 5y ago
      This isn't really any clearer than your earlier comment. > iframe is a full page. An iframe loads whatever you give it. If you give it a URL to a "full page"/"whole page", then it loads that. If the URL leads to e.g. "a div" or "a table", then that will be loaded. That's under the control of the person who's putting stuff on the other end of the URL. To repeat, there is exactly one case where this doesn't hold up: when you want the loaded content to be inline and not block-level (e.g. "some text"—and if inline content is what you meant, then you should say that instead of just giving another vague response; again, though, even if that is what you want, how would that be relevant to the use case we're talking about here: embedding tweets?)

0des 5y ago

Guess I'll start on that exploit now, beat the crowd.