Re: Seamless iframes + CSS3 selectors = bad idea

On Dec 8, 2009, at 1:24 AM, gaz Heyes wrote:

> 2009/12/8 Adam Barth <w3c@adambarth.com>
> One of my favorite parts about security is that "the buck stops here,"
> meaning finger-pointing about who's responsible for what doesn't
> really matter.  In the end, we need to consider the security of the
> system as a whole.
>
> If you agree that we ought to do something about the threat of
> stealing CSRF tokens with attribute selectors, then the question
> becomes "what should we do?" not "who's responsible for the problem?"
>
> So, what should we do?
>
> One possible solution would be to ignore hidden field types and  
> password field types when using selectors. So for example:-
>
> <style>
> input[value*="a"]#token {
> /*
> Any rules are disabled or limited as the field type is hidden
> */
> }
> </style>
> <input type=hidden id=token value=supersecret>

Another possibility is to specifically blacklist the use of the  
contents of the "value" attribute in attribute selectors for elements  
in the HTML namespace. Either all elements, or specifically input  
elements, or more specifically input elements of type password or  
hidden.

I think that is better than making attribute selectors not work with  
those elements at all. People validly use attribute selectors on form  
controls based on the "type" attribute to style them.

Regards,
Maciej