SEC: XSS: JS/CSS Injection

[westurner]

CSS styles of displayed pages override the IPython notebook interface styles with URLs like e.g. http://downforeveryoneorjustme.com.

Without using IFrames, I'm not sure whether it's possible to avoid this without something like:

def cleaned_beautifulsoup_copy(soup):
    copy = BeautifulSoup(unicode(soup))
    for node in copy('script'):
        node.extract()
    # <here
    for node in copy('style'):
        node.extract()
    # /here>
    return copy

EDIT: Also JS.

[westurner]

[Also] a shortcut for rendering just the prettified HTML version (and/or a conditional contextual setting for defaulting to said behavior) would be outstanding. What an excellent teaching tool.

[Psycojoker]

I'm not closing this one after the pull request since the problem is still here. Iframe looks like a good idea, maybe I'll explore it.

[westurner]

Good call. On further review, it looks like IFrames may introduce additional (those possibly lesser) concerns.

For reference, this is a Cross-Site Scripting (XSS) concern:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

• http://cwe.mitre.org/top25/#CWE-79
• http://cwe.mitre.org/data/definitions/79.html

As the warning in configure_ipython_beautifulsoup explains, removing ('extracting') explicit <script> and <style> tags doesn't address:

• CSS added with <link rel="stylesheet" .../>
• CSS added with JS

Approaches

Whitelisting

The HTML tags and attributes could be processed through a whitelis with something like https://pypi.python.org/pypi/bleach, but:

• can/could/would strip CSS loaded with JS through e.g. onclick attributes
• can/could/would strip un-whitelisted logical and presentational attributes like those utilized in JS toolkits

IFrames

IFrames may be the 'safest' bet, though IFrames do introduce additional domain concerns.

• If they reference external urls, the IFrame content is not included in the .ipynb
• Some browser extensions/policies (NoScript, ) block IFrames
• https://stackoverflow.com/questions/7289139/why-are-iframes-considered-dangerous-and-a-security-risk