Re: HTML imports: new XSS hole?

Yes, that's true. Content filters are likely to miss the links themselves.
Hopefully, the imported documents themselves get filtered, but there's no
guarantee. One assumption we can possibly make is that any implementation
that knows how to follow import links ought to know that they need to be
filtered. Im not aware of any current user agents that are not import aware
that automatically follow and execute link tags.
On Jun 2, 2014 6:12 AM, "Boris Zbarsky" <bzbarsky@mit.edu> wrote:

> On 6/2/14, 9:02 AM, James M Snell wrote:
>
>> I suppose that If you
>> needed the ability to sandbox them further, just wrap them inside a
>> sandboxed iframe.
>>
>
> The worry here is sites that currently have html filters for user-provided
> content that don't know about <link> being able to run scripts.  Clearly
> once a site knows about this they can adopt various mitigation strategies.
>  The question is whether we're creating XSS vulnerabilities in sites that
> are currently not vulnerable by adding this functionality.
>
> -Boris
>
> P.S. A correctly written whitelist filter will filter these things out.
>  Are we confident this is standard practice now?
>
>