search

googlearchive / caja

Caja is a tool for safely embedding third party HTML, CSS and JavaScript in your website.
Apache License 2.0
1.13k stars 127 forks source link

Document the contract of each component that performs a security-critical task #608

Open kpreid opened 9 years ago

kpreid commented 9 years ago

Original issue 608 created by zestyping on 2008-06-14T00:05:34.000Z:

For example, for the HTML sanitizer, specify what "sanitized HTML" consists of. And so on, for each component that makes some sort of security promise: clearly specify the security promise so that a reviewer or maintainer can, given example input/output, tell whether the component has succeeded at upholding its promise.

kpreid commented 9 years ago

Comment #1 originally posted by zestyping on 2008-06-14T00:05:58.000Z:

(Split this out into individual issues as necessary for each component.)

kpreid commented 9 years ago

Comment #2 originally posted by davidsarah.hopwood on 2008-06-15T03:15:19.000Z:

<empty>

kpreid commented 9 years ago

Comment #3 originally posted by erights on 2008-09-08T01:12:26.000Z:

<empty>

kpreid commented 9 years ago

Comment #4 originally posted by jasvir on 2013-03-06T19:36:53.000Z:

Prioritizing as "low" refactoring the server-side cajoler to improve maintainability - future improvements are based around the client side rewriter.

kpreid commented 9 years ago

Comment #5 originally posted by erights on 2013-07-11T18:57:07.000Z:

<empty>

kpreid commented 9 years ago

Comment #6 originally posted by kpreid@google.com on 2013-11-07T20:30:08.000Z:

<empty>