4 ms·

They serve user supplied JS from googledrive.com domain? Can it be done in a secure way?

by mixedbit 14y ago

rgbrenner 14y ago
What security issue are you thinking of? JavaScript doesn't run anything server-side...
- lmkg 14y ago
  Being able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the malicious JS would be from the same origin, it's no longer cross-site, and gets a free pass around some of the browser's anti-XSS features.
  - rgbrenner 14y ago
    thanks... good info.. I knew I was forgetting something..
- mixedbit 14y ago
  JavaScript can access any page and cookie from the same domain. So if I visited your googledrive.com hosted site, JavaScript from your site could potentially retrieve and send to you any other content on googledrive.com to which I have access.
  - rgbrenner 14y ago
    thanks.. I was sure I was forgetting something...
adhipg 14y ago
Dropbox also does that. You can potentially host your website within your 'Public' Dropbox folder. I'm sure Google is not using http://googledrive.com/ http://googledrive.com/ for anything that's user-identifiable. The only harm that I think can happen with JS is you being able to access/set any cookies/storage that are set by another 'public' site hosted on Google Drive that you've accessed earlier.
- mchanson 14y ago
  Dropbox shuts links down if you get any significant traffic.
  - businessleads 14y ago
    That doesn't sound very fun...
  - ollieglass 14y ago
    Really? Could you give more detail - at what level of traffic do they shut down links?
    - mchanson 14y ago
      https://www.dropbox.com/help/45/en https://www.dropbox.com/help/45/en Looks like 20GB (free) or 200GB (paid) per day.
      - jjsz 14y ago
        That's PER link, so you can drop it in another folder, change the link, and maybe it refreshes since it's a different link? Can someone from Dropbox confirm this?
      - qued 14y ago
        Seems like more than enough for simple sites shared with a bunch of people you know. That is about 600 GBs of bandwidth a month, for free. If you need more bandwidth, you would probably be looking at any of the other innumerable hosting solutions available on the web.
- eli 14y ago
  Note that Dropbox discourages the use of Public folders. New accounts don't get one unless you know to request it.
- FooBarWidget 14y ago
  > I'm sure Google is not using http://googledrive.com/ http://googledrive.com/ for anything that's user-identifiable. Look at the screenshot in the article. It is in fact using https://googledrive.com/ https://googledrive.com/
yanw 14y ago
Google Online Security Blog - Content hosting for the modern web: http://googleonlinesecurity.blogspot.com/2012/08/content-hosting-for-modern-web.html http://googleonlinesecurity.blogspot.com/2012/08/content-hos...

They serve user supplied JS from googledrive.com domain? Can it be done in a secure way?

rgbrenner 14y ago

What security issue are you thinking of? JavaScript doesn't run anything server-side...

lmkg 14y ago
Being able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the malicious JS would be from the same origin, it's no longer cross-site, and gets a free pass around some of the browser's anti-XSS features.
- rgbrenner 14y ago
  thanks... good info.. I knew I was forgetting something..
mixedbit 14y ago
JavaScript can access any page and cookie from the same domain. So if I visited your googledrive.com hosted site, JavaScript from your site could potentially retrieve and send to you any other content on googledrive.com to which I have access.
- rgbrenner 14y ago
  thanks.. I was sure I was forgetting something...

adhipg 14y ago

Dropbox also does that. You can potentially host your website within your 'Public' Dropbox folder. I'm sure Google is not using http://googledrive.com/ http://googledrive.com/ for anything that's user-identifiable. The only harm that I think can happen with JS is you being able to access/set any cookies/storage that are set by another 'public' site hosted on Google Drive that you've accessed earlier.

mchanson 14y ago
Dropbox shuts links down if you get any significant traffic.
- businessleads 14y ago
  That doesn't sound very fun...
- ollieglass 14y ago
  Really? Could you give more detail - at what level of traffic do they shut down links?
  - mchanson 14y ago
    https://www.dropbox.com/help/45/en https://www.dropbox.com/help/45/en Looks like 20GB (free) or 200GB (paid) per day.
    - jjsz 14y ago
      That's PER link, so you can drop it in another folder, change the link, and maybe it refreshes since it's a different link? Can someone from Dropbox confirm this?
    - qued 14y ago
      Seems like more than enough for simple sites shared with a bunch of people you know. That is about 600 GBs of bandwidth a month, for free. If you need more bandwidth, you would probably be looking at any of the other innumerable hosting solutions available on the web.
eli 14y ago
Note that Dropbox discourages the use of Public folders. New accounts don't get one unless you know to request it.
FooBarWidget 14y ago
> I'm sure Google is not using http://googledrive.com/ http://googledrive.com/ for anything that's user-identifiable. Look at the screenshot in the article. It is in fact using https://googledrive.com/ https://googledrive.com/

yanw 14y ago

Google Online Security Blog - Content hosting for the modern web: http://googleonlinesecurity.blogspot.com/2012/08/content-hosting-for-modern-web.html http://googleonlinesecurity.blogspot.com/2012/08/content-hos...