Quarantining crap HTML?

Thu May 23 08:09:29 BST 2013

On 05/22/2013 07:53 PM, David Dorward wrote:
> On 22 May 2013, at 16:29, DAVID HODGKINSON wrote:
>
>> On 21 May 2013, at 13:14, Philip Skinner <me at philip-skinner.co.uk> 
>> wrote:
>>> You can specify the content of an iframe using a javascript call in 
>>> the src:
>>> <iframe src="javascript:'<html><body><b>hurrah, another 
>>> iframe</b></body></html>';"></iframe>
>
>> Upon sleeping on it, this was the direction I was headed in.
>>
>> The problem is the HTML is user-generated and we know where that
>> leads.
>
> If I were using that approach, I'd host the HTML on a different domain 
> (to use the Same Origin Policy to protect my site against JS attacks 
> from the HTML) and cover it with anti-evil HTTP headers (to stop 
> people including frame buster scripts).
>
> http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-00
>
> (Not that that would be the first approach I'd consider, I'd tend 
> towards parsing the HTML, running it through a whitelist to determine 
> what attributes were acceptable or not and then spitting out something 
> valid and non-evil though.)
>
Plus remember to set a restrictive P3P policy on the domain/subdomain 
hosting that stuff.