4 ms·
I am not an expert in security but when I started using github pages a week ago. When I realized I could put any Javascript on the github.com domain I thought:
by batiste 14y ago
I am not an expert in security but when I started using github pages a week ago. When I realized I could put any Javascript on the github.com domain I thought: good luck with making this secure.
- homakov 14y agothere is no way to make it secure, lol :D
- ZoFreX 14y agoWhat about only letting users customise CSS and HTML? Can that be secure?
- homakov 14y agoJS CSS HTML are very mixed in each other. It is very hard to allow only CSS/HTML.
- Jabbles 14y agoMay I recommend https://js-quasis-libraries-and-repl.googlecode.com/svn/trunk/safetemplate.html https://js-quasis-libraries-and-repl.googlecode.com/svn/trun... as a good read. It examines a system that can safely escape content based on its context, and forms the basis of one of the template packages of Go.
- homakov 14y agobtw <meta http-equiv=Set-Cookie> may behave same way!
- homakov 14y agobest xss protection - http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html http://homakov.blogspot.com/2013/02/pagebox-website-gatekeep...
- ZoFreX 14y agoThanks for the rec, this looks really good! Reminds me a lot of XHP.
- ZoFreX 14y agoAlright... what if they could only change the CSS, and not the HTML and JS? (Obviously not a solution for Github pages, but workable in some scenarios)
- eli 14y agoStill sounds dangerous to me. It's possible to execute code from CSS! https://code.google.com/p/browsersec/wiki/Part1#Cascading_stylesheets https://code.google.com/p/browsersec/wiki/Part1#Cascading_st...