W3C home > Mailing lists > Public > whatwg@whatwg.org > February 2009

[whatwg] Dealing with UI redress vulnerabilities inherent to the current web

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Wed, 18 Feb 2009 10:27:47 -0500
Message-ID: <499C28F3.6090302@mit.edu>
On Thu, 25 Sep 2008, Michal Zalewski wrote:
> 1) Create a HTTP-level (or HTTP-EQUIV) mechanism along the lines of
>    "X-I-Do-Not-Want-To-Be-Framed-Across-Domains: yes" that permits a web
>    page to inhibit frame rendering in potentially dangerous situations.
>
>    Pros:
>
>    - Super-simple
>
>    Cons:
>
>    - "Opt-in", i.e. currently vulnerable sites remain vulnerable unless
>      action is taken

Right.  And really no different from:

   <script>
     if (window != window.top)
       window.top.location.href = window.location.href;
   </script>

in effect, right?  This last already works in all browsers except IE, 
which is presumably why IE felt the need to add another way to do it.

There _is_ an issue here if script is disabled, of course.  In that 
case, are there still situations where the parent frame can effectively 
mislead the user?

> 2) Add a document-level mechanism to make "if nested <show this> else
>    <show that>" conditionals possible without Javascript. One proposal is
>    to do this on the level of CSS (by using either the media-dependency
>    features of CSS or special classes); another is to introduce new HTML
>    tags. This would make it possible for pages to defend themselves even
>    in environments where Javascript is disabled or limited.

Right, addressing the concern above.  The pro is that it ties 
information directly to the document.  The con is that it's harder to 
deploy site-wide....  Is that a concern?

-Boris
Received on Wednesday, 18 February 2009 07:27:47 UTC

This archive was generated by hypermail 2.3.1 : Monday, 13 April 2015 23:08:47 UTC