On 05/22/2013 07:53 PM, David Dorward wrote:
On 22 May 2013, at 16:29, DAVID HODGKINSON wrote:
On 21 May 2013, at 13:14, Philip Skinner <m...@philip-skinner.co.uk>
wrote:
You can specify the content of an iframe using a javascript call in
the src:
<iframe src="javascript:'<html><body><b>hurrah, another
iframe</b></body></html>';"></iframe>
Upon sleeping on it, this was the direction I was headed in.
The problem is the HTML is user-generated and we know where that
leads.
If I were using that approach, I'd host the HTML on a different domain
(to use the Same Origin Policy to protect my site against JS attacks
from the HTML) and cover it with anti-evil HTTP headers (to stop
people including frame buster scripts).
http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-00
(Not that that would be the first approach I'd consider, I'd tend
towards parsing the HTML, running it through a whitelist to determine
what attributes were acceptable or not and then spitting out something
valid and non-evil though.)
Plus remember to set a restrictive P3P policy on the domain/subdomain
hosting that stuff.
