Re: XSS mitigation in browsers

On 19 January 2011 22:42, Adam Barth <w3c@adambarth.com> wrote:

> As I'm sure many of you are aware, various folks from Mozilla have
> proposed Content Security Policies
> <https://wiki.mozilla.org/Security/CSP> as a way of improving the
> security of web pages by including a security policy.  I'm interested
> two aspects of CSP:
>

 A while ago I had the idea of using zones protected by a randomized token:-
<http://www.thespanner.co.uk/2010/09/24/xss-zones/>

You use a randomized zone to protect a section of the site, the problem is
it would require browser support and the server to generate a random key.

An alternative idea would be to use a security policy like a CSS file, since
webdevs are already used to this. Something like:-

<link href="http://hackvertor.co.uk/policy.csp" rel="policy"
type="text/policy" />

So by default the browser denies everything (forms, events, script etc) then
the policy dictates which elements are allowed and which urls (
http://hackvertor.co.uk/policy.csp):-
script {
  src:url(https://chart.googleapis.com) url(http://chart.googleapis.com);
  inline: false;
}

You can be specific like:-
#emailContent {
  javascript:false;
  forms: false;
  img: true;
}

This way we could reuse the CSS parsing that already exists but the policy
files would obviously have to be much stricter in what they allow.