From: Subject: How to Safeguard Your Site with HTML5 Sandbox - SitePoint Date: Sun, 13 May 2012 17:23:35 +0500 MIME-Version: 1.0 Content-Type: multipart/related; type="text/html"; boundary="----=_NextPart_000_0000_98104AA9.56E4C13E" X-MAF-Information: Produced By MAF V2.0.6 This is a multi-part message in MIME format. ------=_NextPart_000_0000_98104AA9.56E4C13E Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Content-Location: http://www.sitepoint.com/how-to-safeguard-your-site-with-html5-sandbox/ How to Safeguard Your Site with HTML5 Sandbox - SitePoint = text/javascript= = SitePoint =C2=BB Learn CSS | HTML5 | JavaScr= ipt | Wordpress | Tutorials-Web Development | Reference | Books and More HomeForum= s =C2=BBWeb ContentDesign Your SiteProgram Your SiteHost Your SiteManage Your SiteCommu= nity CenterResources =C2=BBNew= slettersPodcastCSS Ref= erenceHTML Ref= erenceJa= vascript Reference= ToolsHTML5 Dev CenterDealsBookstore =C2=BBTop SellersDevelopmentDesignASP.net BooksCSS= BooksHTML BooksJavascript BooksPHP BooksMarketCoursesHosting ReviewsJobsSitepoint Network =C2= =BBB= uildMobileDesignFestivalRubySourceCloudSpringPHPMasterSite= Point Market Hot TopicsLearn PHPHTML5CSS3Web DesignWordPressRuby on RailsMobileCloud HTML5 Development Center Developed for you in part by =C2=A0 = How to Safeguard Your Site with HTML5 Sandbox By Dari= usz Parys | May 7, 2012 | = HTML5 8= 0diggsdigg = EmailPrint 0diggsdiggEmailPrintToday=E2=80=99s web applications are mash ups of new= experiences into one experience. Think Twitter widgets showing the latest= tweets about a product. Or Facebook comments discussing an article. Or eve= n just integrated web pages through an iframe element. These= experiences can increase security breaches to your site.Don= =E2=80=99t stress =E2=80=A6 there=E2=80=99s a new kid on the block to help= you out: the HTML5 sandbox. But before I get to that, let=E2=80= =99s quickly review iframe element issues.A Black BoxEmbedding content with an iframe is like announcing a= party publicly on Facebook. You think you know who you invited, but really= you have no idea who passed it on and who=E2=80=99ll show up.The sa= me is true for framing content. You know what you are referencing, but you= have no clue how the site will evolve in the future. Content or functional= ity (or both) can change any time. Without you knowing =E2=80=A6 an= d without your approval.Security Concerns Using IframeBrowsers handle pages that use iframe just like any other= web page. Forms can be used to retrieve user input, scripts can be execute= d, the page can navigate within the browser window, and browser plugins can= be executed. And just like the party crashers who get out of hand, you have no control what the hosted content will do. There is one mechanism in place by default tha= t prevents some kinds of attacks: the cross-domain policy.Re-hostin= g Content From Another DomainIf hosted content is coming from anoth= er domain, cross-domain policy comes into play and it prohibits the =E2=80= =9Cforeign=E2=80=9D content from accessing the parent=E2=80=99s document ob= ject model.So, the embedded page= is not able to read, for instance, cookies or the browser=E2=80=99s local= storage for the hosted domain. But there are still risks left.Hoste= d content can still re-navigate on the top level. By displaying content the= user would expect, the site could attempt to phish confidential informatio= n from the user. Or, by using a similarly styled form, attempt to malicious= ly capture user information that way.That=E2=80=99s why, even with= the cross-domain policy in place, there are still big security risks.Re-hosting Content From the Same DomainThe case for re-h= osting content from the same domain is even worse.When the= content comes from the same domain, there are no default security restrict= ions in place. Embedded content can access the complete loaded browser DOM= and manipulate everything.It kind of makes sense that content on th= e same domain should be safe. The risk here primarily stems from user-gener= ated content that is re-hosted in the iframe.A Sandboxed ApproachThese valid security= concerns hadn=E2=80=99t been properly addressed by a standards body for a= long time. Without a clear W3C standard, it was essential to somehow secur= e the host from framed content. For example, Microsoft provided a proprietary implementation of iframe= security in Internet Explorer 8. Others picked it up and discussed= it as the baseline for their browsers as well. But standards have matured= greatly since IE8.Modern browsers including Chrome, Firefox, and IE10 Platform Preview are based on the W3C iframe sandbox attribute.Here=E2=80=99s what= we=E2=80=99ll build today with sandbox. See the demo here.Let=E2=80=99s begin by applying the sandb= ox. Just add it as empty attribute to the iframe element:<iframe sandbox src=3D"http://somewebsite.com/default.html"></= iframe> That=E2=80=99s it!Now, iframe sandboxed conten= t is re-hosted in the browser with the following restrictions😛lugins are disabled. Any kind of ActiveX, Flash, or Silver= light plugin will not be executed.Forms are disabled. The hosted content is not allowed to make forms post back to any targe= t.Scripts are disabled. JavaScript is disabled an= d will not execute.Links to other browsing contexts are di= sabled. An anchor tag targeting different browser levels will not= execute.Unique origin treatment. All content is= treated under a unique origin. The content is not able to traverse the DOM= or read cookie information.This means that even content comin= g from the same domain is treated with the cross-domain policy, as each iframe content will be viewed as a unique origin.Embedded= content is only permitted to display information. No other action= s can be done inside the iframe that could compromise the host= ing website or take advantage of the users=E2=80=99 trust.Checking= for the Sandbox AttributeWe know that an iframe is an= open gate. We know that the sandbox attribute locks down secu= rity of hosted content. The decision is clear: Use iframe elements just with the sandbox attribute!Y= ou can confirm that the browser supports the iframe sand= box attribute with a simple check in JavaScript:if("sandbox= " in document.createElement("iframe")) { // render the iframe element ... } else { // embed content through other ways, // as the browser does not support the sandbox } If it is supported, just use the sandbox attribute.= If not, try to embed the content through other ways or encourage the user= with a message that they should upgrade to a modern browser.Customizing the SandboxThere are cases where you=E2=80=99ll need some level of customizatio= n on the restrictions, which is absolutely possible.Several attribut= e values relax the standard sandbox policy =E2=80=A6allow-formsIf you want to enable forms post back within the iframe el= ement, you just specify the allow-forms value for the sa= ndbox attribute.<iframe sandbox=3D"allow-forms" src=3D"x= yz.html"></iframe> If this value is present, the embedded page is allowed to post bac= k using a form submit within the frame.allow-scriptsJavaScr= ipt is a powerful language and is often used to have dynamic interactions= on the client side without resending information to the server. But that= power also brings risks when re-hosting foreign web pages. = Therefore, you should carefully consider whether you really want to enable= JavaScript in iframe scenarios=E2=80=94especially when the co= ntent is from an unknown source. Enabling JavaScript is don= e through the allow-scripts value.<iframe sandbox= =3D"allow-scripts" src=3D"xyz.html"></iframe> allow-same-originBy default, an IFRAME page= from the same domain has the possibility to access the parent=E2=80=99s do= cument object model.With the sandbox attribute in place= , the page will be treated as not being from the same origin. This page has= no access to the resources, even when coming from the same domain.T= o re-enable same-origin treatment in a sandboxed scenario, you have to spec= ify the allow-same-origin attribute.<iframe sandbo= x=3D"allow-same-origin" src=3D"xyz.html"></iframe> The value itself is not very helpful, as you need some script capa= bilities to make use of it.For example, if you want to access the lo= cal storage of the current domain like this:function loadFromStora= ge(key) { if(localStorage) { return localStorage.getItem(key); } }); =E2=80=A6 you also need the allow-scripts value:= <iframe sandbox=3D"allow-scripts allow-same-origin" src=3D"xyz.html= "></iframe> Now access works!But be warned: allowing multiple scripts= in the same sandbox can lead to security vulnerabilities. For example, you= r hosted content can manipulate the attributes of the sandbox and remove fu= rther restrictions.allow-top-navigationWhen you use the sandbox attribute, anchor targeting other browsing contexts are= ignored and not executed by default. This protects the website hosting the= iframe content from being replaced by the hosted content.= For example, this link would not be executed in the default sandbox, as= the target would replace the complete web page:<a href=3D"xyz.= html" target=3D"_top">Click me</a> Relaxing this policy is only recommended if you trust the content= you host.<iframe sandbox=3D"allow-top-navigation" src=3D"xyz.h= tml"></iframe> ms-allow-popupsSometimes it is useful to allow embedded= content opening up new popup windows. A perfect example is a mapping servi= ce like Bing Maps.When embedding Bing Maps, additional functionality= like driving directions or destination details can be looked up in popup= windows. But since sandbox prohibits this, there=E2=80=99s a= setting in Internet Explorer 10 that will enable popups without compromisi= ng the sandbox.The following code show

yaman men sowmana okdeda....

#asly_marylylardan bolanlar sowmane okdemish