search

w3c / FileAPI

File API
https://w3c.github.io/FileAPI/
Other
104 stars 44 forks source link

Put policies in the blob URL store #142

Open annevk opened 4 years ago

annevk commented 4 years ago

It would be ideal that when URL.createObjectURL() is invoked all policies (CSP, referrer policy, etc.) are cloned and stored in the blob URL store so that they can be used when the blob URL is used to create a document.

This might have to be somewhat hand-wavy initially, but can hopefully be formalized over time as we document how to create, store, and inherit policies.

(In particular this approach helps ensure that however the user decides to open the blob URL, relevant policies will be there and there's not some escalation of privilege possible relative to the document that minted the URL.)

cc @mikewest @hiroshige-g

mikewest commented 4 years ago

I like it, but I'm completely disconnected from the implementation details. :) @mkruisselbrink and @inexorabletash will know who might have (hopefully positive!) opinions about this in Chromium.

mikewest commented 4 years ago

This (and https://github.com/whatwg/html/issues/4926) cropped up again in an conversation around some things that Google Docs/Drive wants to do with blobs; tl;dr: Google's security team is unhappy with blobs as they exist today, and is uncomfortable approving blob-based flows for dynamically generated content. They'd be much happier if either: a) Blobs inherited the security policies associated with the context that created them, and/or b) Blobs could be constructed in a way that didn't inherit the origin of its creator (a la https://github.com/w3c/FileAPI/issues/74#issuecomment-311785512).

I haven't had time to look into this set of work since TPAC. I'm hoping we can find time in Q2. Is that something Mozilla folks would be interested in collaborating on, Anne?

koto commented 4 years ago

For our use cases I think b) is a more useful primitive than a), but we should have both. a) seems like a bugfix, but b) allows you to isolate user-generated content from the application code more easily. The use cases are usually generating user content for previewing in iframe, downloading or printing.

annevk commented 4 years ago

Yes, though I'd be primarily interested in addressing a) as adding more primitives to rather shaky foundations doesn't inspire confidence. (#135 is another problematic bit with fetching blobs.)