Comments for The Spanner

Comment on CSP - Mozilla content security policy by Gareth Heyes

Gareth Heyes — Tue, 30 Jun 2009 07:47:12 +0000

@Brandon

No probs I’ll look forward to testing the beta

Regards the meta tag, when http header is used the meta should be ignored IMHO. If the strict rules are followed as in the spec. like the meta follows the head tag then it will be fine.

Comment on CSP - Mozilla content security policy by Brandon Sterne

Brandon Sterne — Mon, 29 Jun 2009 23:00:19 +0000

Great post, Gareth. I’d like to respond to a few of the points you brought up.

1. The E4X trick is a good one. I have updated the spec to require that external scripts be served with a valid MIME type for JavaScript. Great catch!

2. With regard to “no code from strings”, Wladimir’s post pretty much covers it. eval provides too much rope for developers to hang themselves with, so CSP turns it off by default. Of course, sites that absolutely need to use those APIs can turn this restriction off.

3. Regarding policy, I think you and Wladimir raised all the relevant points. There’s no specific security risk that an injected policy introduces, but it could cause bustage for the page. In fact Sid, one of the developers implementing CSP, has proposed removing it from the design:
http://blog.sidstamm.com/2009/06/csp-with-or-without-meta.html
I don’t feel strongly in favor of keeping it, but I do know that some users aren’t able to set HTTP headers in their environment. This is a risk vs. reward that will have to be considered.

Thanks again for the great feedback and I can’t wait to see what you’ll produce when you get a nightly build in your hands with a working implementation!

Comment on New beta of JSReg by Gareth Heyes

Gareth Heyes — Sat, 27 Jun 2009 14:49:36 +0000

@Vitaly

I don’t understand your point, I’ve not implemented eval or unescape yet

Comment on New beta of JSReg by Vitaly

Vitaly — Fri, 26 Jun 2009 23:15:40 +0000

Does not work with obfuscated JS appended to the end of:

hxxp://wxx.colcohist-gensoc.org/mysql/onename.php

Comment on CSP - Mozilla content security policy by Gareth Heyes

Gareth Heyes — Fri, 26 Jun 2009 14:01:53 +0000

@Wladimir

If you can only make the policy stricter this is still no good because you are giving the attacker control over the page. Should an attacker be able to remove the eval function from a page? Or maybe disable images from an external site, yeah it’s not as serious as modifying the policy by adding it but it is still an issue IMHO.

Comment on CSP - Mozilla content security policy by Wladimir Palant

Wladimir Palant — Fri, 26 Jun 2009 13:57:41 +0000

Should have been “a few pages” rather than “a few sites” above.

Comment on CSP - Mozilla content security policy by Wladimir Palant

Wladimir Palant — Fri, 26 Jun 2009 13:56:42 +0000

Gareth, the meta tag is in fact not problematic since it can only make the policy stricter - this is of no use to the attacker. But I really wonder how a situation can happen where both the headers and the meta tag can be specified. Probably a server with a generically strict policy (all content served with the same headers) where a few sites want an even stricter policy.

Comment on Detecting browsers javascript hacks by Инокентий

Инокентий — Thu, 25 Jun 2009 12:38:59 +0000

Хорошая статья, больше бы таких!

Comment on CSP - Mozilla content security policy by Gareth Heyes

Gareth Heyes — Wed, 24 Jun 2009 08:12:28 +0000

@ebo

I think the more sensible option would be for the http header to take priority when used and ignore an attacker supplied meta tag

Comment on CSP - Mozilla content security policy by ebo

ebo — Wed, 24 Jun 2009 08:06:33 +0000

“meta tag could merge policy” If a http header X-Content-Security-Policy is already set, you can’t merge the policy with your meta tag. In according to the spec, a new policy will be created from the intersection of the two policies.