5 ms·

As usual, this sounds great for the nice players. Unfortunately that means if you download an html file and double click on it then it can send anything in you

by IanCal 2y ago

As usual, this sounds great for the nice players. Unfortunately that means if you download an html file and double click on it then it can send anything in your downloads folder to anywhere else.

jagged-chisel 2y ago
Download HTML file (and dependencies), open local file, local JS requests from internet, and CORS error. Why can it not work like this?
- IanCal 2y ago
  > local JS requests from internet I really don't understand what this means.
  - jonhohle 2y ago
    If you load a file using the “file” protocol, it shouldn’t be able to load other resources (JS from the internet) with non-file protocols to protocols (http, https, etc.) to non null-string domains. because that would violate cross origin request sharing (CORS). I too like local HTML and would love to see it restored without requiring a local server. If I spin up a local Webrick to serve anything from my file system, I’m no better off (except maybe that it’s scoped to a particular directory and children).
    - advisedwang 2y ago
      People expect to be able to download an HTML file and for it still to be able to load an image with an external URL. If it can do that, it can exfiltrate (eg js can put data loaded from a local file in the src for an image on a external server).
      - jagged-chisel 2y ago
        When I save an HTML page, the browser downloads other resources the page wants. This is how it should work for The Average User. Saving just the HTML should be the exception for more technical users.
  - deleted 2y ago
    [deleted]
bandie91 2y ago
or just separete what are "document" and what are "application", already, and don´t mix them up. i would not even mind if there was a separate "docjs" - JS code for which only the document is visible and only can do stuff upon it, and the "appjs" which can do all of the wild js stuff which our great browser vendors come up with. this way, in various cases, you can turn off the potentially harmful appjs, while keep the docjs for validating forms, change layout, implementing tinymce, etc... IMO the problem rooted in co-mingling documents and applications on a web page / in a HTML file. let the user save documents in .html: then it should not be able to do any harm - it's a digital sheet of paper! and web applications in, say, .hta: then he should not expect any more isolatedness then for a downloaded .exe or .sh file; and the user client program should treat it with due care when downloading, eg. by put it in a separate subfolder, set SELinux context, etc...

by IanCal 2y ago

As usual, this sounds great for the nice players. Unfortunately that means if you download an html file and double click on it then it can send anything in your downloads folder to anywhere else.

jagged-chisel 2y ago

Download HTML file (and dependencies), open local file, local JS requests from internet, and CORS error. Why can it not work like this?

IanCal 2y ago
> local JS requests from internet I really don't understand what this means.
- jonhohle 2y ago
  If you load a file using the “file” protocol, it shouldn’t be able to load other resources (JS from the internet) with non-file protocols to protocols (http, https, etc.) to non null-string domains. because that would violate cross origin request sharing (CORS). I too like local HTML and would love to see it restored without requiring a local server. If I spin up a local Webrick to serve anything from my file system, I’m no better off (except maybe that it’s scoped to a particular directory and children).
  - advisedwang 2y ago
    People expect to be able to download an HTML file and for it still to be able to load an image with an external URL. If it can do that, it can exfiltrate (eg js can put data loaded from a local file in the src for an image on a external server).
    - jagged-chisel 2y ago
      When I save an HTML page, the browser downloads other resources the page wants. This is how it should work for The Average User. Saving just the HTML should be the exception for more technical users.
- deleted 2y ago
  [deleted]

bandie91 2y ago

or just separete what are "document" and what are "application", already, and don´t mix them up. i would not even mind if there was a separate "docjs" - JS code for which only the document is visible and only can do stuff upon it, and the "appjs" which can do all of the wild js stuff which our great browser vendors come up with. this way, in various cases, you can turn off the potentially harmful appjs, while keep the docjs for validating forms, change layout, implementing tinymce, etc... IMO the problem rooted in co-mingling documents and applications on a web page / in a HTML file. let the user save documents in .html: then it should not be able to do any harm - it's a digital sheet of paper! and web applications in, say, .hta: then he should not expect any more isolatedness then for a downloaded .exe or .sh file; and the user client program should treat it with due care when downloading, eg. by put it in a separate subfolder, set SELinux context, etc...