Preventing direct access to standboxed content

[tristanz]

This is more of a questions than a bug. What prevents users from just directly accessing the standboxed content is these examples? For instance:

//mydomain.com/samples/profile_viewer/profile_viewer.html

If a user clicks on a link to that, the widget author can now get that user's cookies. Is the idea to send server content in some other manner where direct access is impossible? Does this preclude allow users to write widgets that have multiple files?

I understand the workaround is to host user generated content on a different domain, but this eliminates one of the perks of oasis.js.

[lukemelia]

You can't host untrusted/user-generated code on a domain with sensitive cookies. In a secure oasis deployment, the container, as well as each card, would be hosted on distinct domains.

[cyril-sf]

@tristanz As long as the sandbox attribute isn't supported by all browsers, you would need to host the card/widget on a "safe" domain as @lukemelia mentioned.

[tarcieri]

@cyril-sf didn't you add a allow-same-origin polyfill that causes unsupported browsers to break if they can't sandbox properly?

[cyril-sf]

@tarcieri Correct, Oasis.js will complain if you try to host the card on the same domain. See

oasis.js/lib/oasis/iframe_adapter.js

Lines 10 to 28 in b657d0d

	function verifySandbox(oasis, sandboxUrl) {
	var iframe = document.createElement('iframe'),
	link;
	if( (oasis.configuration.allowSameOrigin && iframe.sandbox !== undefined) ||
	(iframe.sandbox === undefined) ) {
	// The sandbox attribute isn't supported (IE8/9) or we want a child iframe
	// to access resources from its own domain (youtube iframe),
	// we need to make sure the sandbox is loaded from a separate domain
	link = document.createElement('a');
	link.href = sandboxUrl;
	if( !link.host || (link.protocol === window.location.protocol && link.host === window.location.host) ) {
	throw new Error("Security: iFrames from the same host cannot be sandboxed in older browsers and is disallowed. " +
	"For HTML5 browsers supporting the `sandbox` attribute on iframes, you can add the `allow-same-origin` flag" +
	"only if you host the sandbox on a separate domain.");
	}
	}
	}

[tristanz]

I wasn't sure about the use case for same origin support with url source even on browsers that support sandbox attribute. In the example, http://example.com/profile_viewer.html can presumably be accessed directly, not just via the sandboxed iframe. I was wondering (hoping) that you'd found a workaround to this issue to prevent direct access. I'm aware of any browser features that allow that though.

[tarcieri]

@tristanz on browsers that implement <iframe sandbox> correctly, its use should result in the sandboxed content receiving a unique origin even if content is loaded from the same origin as the outer page, unless you specify the allow-same-origin capability, or at least that's my understanding.

The code @cyril-sf linked should ensure that browsers which don't properly sandbox content break rather than loading the content insecurely.

[tristanz]

@tarcieri that's my understanding. The problem is that the insecure content is almost always accessible directly as well, which makes same-domain sandbox not so useful. All you need is for a user to click on the direct URL and that content can steal the cookie. You'd need to prevent direct access, which is in most cases not easy. It is sometimes possible, for instance if you use srcdoc.

[tarcieri]

@tristanz in that case, use CSP to ensure that scripts from the untrusted source can't run (and host all your own scripts on a separate domain which is whitelisted by CSP)