Comments on: Interoperability and XSS Mitigation

By: Arshan Dabirsiaghi

Arshan Dabirsiaghi — Sun, 06 Jan 2008 15:48:25 +0000

Wow your comment consumer totally ate my message. I was displaying a “jail” tag that had 2 attributes, a ruleset identifier and a “secret”. The ability to customize the ruleset will be an important piece of functionality that must be present for that idea to work.

By: Arshan Dabirsiaghi

Arshan Dabirsiaghi — Sun, 06 Jan 2008 15:46:26 +0000

Rob,

This is great stuff – you might want to check out the AntiSamy project. We’ve already setup the framework and a Java implementation for safely validating rich input/content restrictions according to a policy file dictating what elements, attributes, size, etc. can occur. AntiSamy is definitely separated from the pack in that it also validates CSS.

Side note – I’m not in love with the “sandbox header” idea, but I’m always parroting the same line my boss gave me. There’s 4 big browsers, hundreds of thousands of companies writing web applications, and millions of developers throughout the world. Where’s the easiest place to get stuff done?

I like a modification to the jail idea.

As long as you’re using a secure PRNG, you’re in business:

attack_that_fails();

The “rules” attribute could point to previously defined set of rules, either globally known or defined in the page like CSS rules.

By: RSnake

RSnake — Sun, 09 Sep 2007 21:00:22 +0000

Hey, Rob – I’m actually the person who came up with the original concept for content restrictions, and later gave the concept to Rafael who gave it to Gerv (they will verify this). I’m told you are working on this now, so please feel free to drop me a line and I can discuss the origins of it (off this thread) and some more details. I told Mike Shaver that I’d get back to him on this, but if you are taking this over, perhaps you’d be better to speak with.

By: Ezra Cooper

Ezra Cooper — Fri, 10 Aug 2007 10:34:12 +0000

Rob--Another similar proposal is BEEP by Trevor Jim et al., presented at WWW 07. FWIW.

By: Ian Hickson

Ian Hickson — Thu, 09 Aug 2007 23:49:55 +0000

Actually as far as I can tell no browsers are vulnerable to the re-parse bug anymore. (Tested relatively recent versions of Safari, Opera, IE, and Firefox on Windows.) So I’m not sure fixing it would be a Web-compat problem…

By: Michael

Michael — Tue, 07 Aug 2007 17:21:13 +0000

What about digitally signing the javascript blocks? Do you see any problem with that?

Off course, the site would need to use SSL or another specific mechanism.