search

readium / ts-toolkit

A toolkit for ebooks, audiobooks and comics written in Typescript
BSD 3-Clause "New" or "Revised" License
64 stars 10 forks source link

Sandboxing navigator iFrames #84

Open chocolatkey opened 2 weeks ago

chocolatkey commented 2 weeks ago

The iframe elements used to show reflowable and FXL content can be sandboxed using various attributes described here: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe. This can provide security enhancements and protect from malicious EPUBs, especially in a situation where content is user generated.

danielweck commented 2 weeks ago

FYI, possibly useful references:

danielweck commented 1 week ago

the above links are sufficient, but many years ago I wrote a similar EPUB test book to check for window.top and window.parent security breaches in non-sandboxed iframes. I later ported it to the official EPUB test suite (in a branch):

https://github.com/IDPF/epub-testsuite/blob/feature%2FRS_integrity/content%2F30%2Fepub30-test-0160%2FEPUB%2Fxhtml%2Fsecurity-001.xhtml

window.parent.document.body.innerText = “HACKED!”;

window.top.document.getElementById("ID").innerHTML = “ Click here ”;

it's been a while since I last looked into this, but there was this breach method as well:

window.frameElement.ownerDocument.defaultView.location = “http://hack.me”;