Skip to content

Commit bbd1bf2

Browse files
llemeurfrllemeurfr
authored
Annotations Security Considerations (#3075)
* Annotations Security Considerations
1 parent 763f7b3 commit bbd1bf2

1 file changed

Lines changed: 97 additions & 3 deletions

File tree

‎epub34/annotations/index.html‎

Lines changed: 97 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1427,11 +1427,105 @@ <h1>Privacy Considerations</h1>
14271427
<p>T.B.D.</p>
14281428
</section>
14291429

1430-
<section>
1431-
<h1>Security Considerations</h1>
1430+
<section id="security-considerations" class="non-normative">
1431+
<h2>Security Considerations</h2>
1432+
<p>
1433+
The EPUB Annotations specification provides a standardized data model for importing, exporting,
1434+
and displaying annotations. Because annotations can originate from untrusted external sources—such as
1435+
downloaded detached files (<code>AnnotationSet</code>) or crowd-sourced annotation servers—implementations
1436+
must treat all incoming annotation data as potentially malicious.
1437+
</p>
1438+
<p>
1439+
Implementers should design reading systems and processing tools defensively to mitigate the risks of
1440+
injection attacks, malicious resource loading, and denial-of-service, aligning with the guidelines in the
1441+
<a href="https://www.w3.org/TR/security-privacy-questionnaire/">W3C Self-Review Questionnaire: Security and Privacy</a>.
1442+
</p>
14321443

1433-
<p>T.B.D.</p>
1444+
<section id="security-plain-text">
1445+
<h3>Plain Text Handling and Cross-Site Scripting (XSS)</h3>
1446+
<p>
1447+
This specification restricts textual annotation bodies to plain text. Consequently, reading systems MUST NOT
1448+
parse, interpret, or render HTML, XML, or script markup contained within an annotation's <code>body</code>.
1449+
</p>
1450+
<ul>
1451+
<li>
1452+
<strong>Plain Text Enforcement:</strong> Reading systems must process any markup elements or
1453+
entity references (such as <code>&lt;script&gt;</code> or <code>&lt;iframe&gt;</code>) strictly as
1454+
raw text strings. When displaying annotation content within a web-based context or DOM element,
1455+
reading systems must safely escape text or use plain-text insertion methods
1456+
(e.g., <code>textContent</code> in JavaScript) to ensure that embedded code cannot execute.
1457+
</li>
1458+
<li>
1459+
<strong>Auto-linking Risks:</strong> If a reading system automatically parses plain text to render
1460+
hyperlinked URLs within an annotation body, it must validate the URI scheme (limiting active links
1461+
to secure protocols like <code>https:</code>) to prevent execution of malicious schemes
1462+
such as <code>javascript:</code> or <code>file:</code>.
1463+
</li>
1464+
</ul>
1465+
</section>
1466+
1467+
<section id="security-external-resources">
1468+
<h3>External Resources and Network Security</h3>
1469+
<p>
1470+
Annotations can reference external Web resources (e.g., in the <code>target</code> property or when
1471+
referencing external media for audiovisual notes).
1472+
</p>
1473+
<ul>
1474+
<li>
1475+
<strong>Automatic Fetching:</strong> Reading systems should not automatically fetch or render external resources linked in an annotation without explicit user consent. Automatic fetching can be exploited to conduct Server-Side Request Forgery (SSRF) attacks or to expose the user's IP address to third-party tracking servers.
1476+
</li>
1477+
<li>
1478+
<strong>Malicious URIs:</strong> Implementations must validate the URI schemes of all external resources, restricting active requests to secure protocols (e.g., <code>https:</code>) and blocking dangerous schemes (e.g., <code>javascript:</code>, <code>file:</code>, or OS-specific application handlers).
1479+
</li>
1480+
<li>
1481+
<strong>User Warnings:</strong> When an annotation prompts a user to open an external link, the reading system should clearly indicate that the destination is external to the EPUB package and inherently untrusted.
1482+
</li>
1483+
</ul>
1484+
</section>
1485+
1486+
<section id="security-path-traversal">
1487+
<h3>Path Traversal and Local Access</h3>
1488+
<p>
1489+
The [=Target] object utilizes a <code>source</code> property, which must be the URL of an existing resource within the EPUB package (e.g., an HTML document).
1490+
</p>
1491+
<ul>
1492+
<li>
1493+
<strong>Container Bounding:</strong> When resolving the <code>source</code> URL against the EPUB package, reading systems must prevent path traversal attacks. Implementations must ensure that malicious paths (e.g., <code>../../../../etc/passwd</code> or <code>../outside-container.html</code>) cannot be used to escape the bounds of the EPUB container or access local system files.
1494+
</li>
1495+
</ul>
1496+
</section>
1497+
1498+
<section id="security-dos">
1499+
<h3>Algorithmic Complexity and Denial of Service (DoS)</h3>
1500+
<p>
1501+
Processing deeply nested annotation data or calculating complex selectors can be weaponized to consume excessive CPU or memory, leading to a Denial of Service.
1502+
</p>
1503+
<ul>
1504+
<li>
1505+
<strong>Selector Complexity:</strong> The [=Selector=] object (particularly CSS Selectors and Text Position Selectors) requires the reading system to traverse the Document Object Model (DOM) to locate specific segments. Attackers may craft overly complex CSS selectors or extreme text coordinate ranges designed to hang the rendering engine. Implementations should enforce execution time limits and depth limits when applying selectors.
1506+
</li>
1507+
<li>
1508+
<strong>JSON Parsing:</strong> As EPUB Annotations are serialized in JSON/JSON-LD, implementations must use secure parsing libraries configured to limit maximum file size, string length, and nesting depth to prevent memory exhaustion or "Billion Laughs"-style parser attacks.
1509+
</li>
1510+
</ul>
1511+
</section>
1512+
1513+
<section id="security-spoofing">
1514+
<h3>Spoofing and Data Integrity</h3>
1515+
<p>
1516+
When annotations are imported from a detached [=AnnotationSet=], reading systems have no inherent guarantee of the data's authenticity.
1517+
</p>
1518+
<ul>
1519+
<li>
1520+
<strong>Creator Forgery:</strong> The [=Creator=] object can be easily forged. An attacker could craft an annotation file that appears to come from a trusted source (such as a teacher, publisher, or known peer) but contains misleading or offensive notes.
1521+
</li>
1522+
<li>
1523+
<strong>Integrity Validation:</strong> Implementers should treat the [=Creator=] metadata in detached files as unverified unless the annotation set is transmitted over a secure, authenticated channel (like an authenticated API) or is cryptographically signed. Reading systems should visually distinguish between locally authored annotations and untrusted imported annotations.
1524+
</li>
1525+
</ul>
1526+
</section>
14341527
</section>
1528+
14351529
<section class="appendix" id="index"></section>
14361530
<section class="appendix" id="issue-summary"></section>
14371531
</body>

0 commit comments

Comments
 (0)