W3C home > Mailing lists > Public > public-web-security@w3.org > January 2011

Re: [Content Security Policy] Proposal to move the debate forward

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Fri, 28 Jan 2011 15:53:17 -0500
Message-ID: <4D432CBD.1080804@mit.edu>
To: Adam Barth <w3c@adambarth.com>
CC: public-web-security@w3.org
On 1/28/11 3:33 PM, Adam Barth wrote:
>> Does allowing attackers to rewrite the text on your page (but not run any
>> script) have security impact?
>>
>> Allowing arbitrary font loads allows various attacks that depend on
>> misinforming the user about what buttons and such will do, for example.
>
> In this threat model, they can already do both those things without
> the ability to load fonts.  They just make an opaque DIV that covers
> the whole page and write whatever they like into it.

I think we're talking about different threat models.

In my threat model, the page does not allow injection of script, and 
possibly not of content, but does allow some styling.

The attacker's goal is to get some of the page-provided script to run, 
or a page-provided form to be submitted, with data the attacker can 
control or influence.

Covering the whole page with a div won't do the trick there.

-Boris
Received on Friday, 28 January 2011 20:53:54 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Friday, 28 January 2011 20:53:54 GMT