Comments (2)
I think we should allow relative URLs so that's my bias but below I enumerate some intermediate measures and pros/cons. Not remotely exhaustive.
Possible Postures
Allow relative URLs
Disallow all relative URLs
Including
- protocol-relative URLs (
//authority/path
), - path-relative (
/path
), - query (
?key=value
), and - fragment-only (
#fragment
)
Allow Fragment-only URLs but not others
There are several kinds of relative URLs, but Std66 calls them out for special treatment because fragments are part of a URI reference, and a fragment-only change does not cause the browser to issue a network fetch.
Make this per-IDL property
Perhaps with an additional property AllowRelative annotation.
Maybe treating differently the IDL properties that resolve against a base URL besides the document base would be a natural kind of distinction to make.
Risks
Requiring absolute URLs makes migration difficult
I can't really quantify this but my sense is that relative URLs are so widely used that disallowing them would be a significant blocking factor to adoption, and that the main workaround would be to insert code that resolves relative URLs against the document's base URL at creation time which would have a similar risks to just allowing them, and would deprive the IDL property handlers of possibly valuable context.
Safe URL resolved against base URL with unexpected protocol
This is possible since not all URLs are resolved against the document's base. For example, imported stylesheets are resolved against the URL of the stylesheet containing the import statement. Similarly for HTML imports.
Part of a system blesses simple path URLs like /%0aalert(1)
and the base URL is something like javascript://foo/
, then the system might produce javascript://foo/%0aalert(1)
which executes the JavaScript
//foo/
alert(1)
My understanding is that a non-hierarchical URL like the above can be a base URL because some opaque schemes like about:
and mailto:
do have query components.
javascript:
is not a hierarchical URL and does not allow a query component, so my understanding of Std 66 Sec 5 is that resolving the above should yield just the base URL: javascript://foo/
.
In any event, resolving a relative URL against an opaque URL should result in a URL in a different origin per https://url.spec.whatwg.org/#origin:
"file"
Unfortunate as it is, this is left as an exercise to the reader. When in doubt, return a new opaque origin.Otherwise
Return a new opaque origin.
Relative URL masks attack
In some cases, an attack is more apparent when seen in context:
../../../../../../etc/shadow
is less obviously problematic than https://example.com/../../../../../../etc/shadow
since the latter obviously requires dropping ..
silently during normalization.
Encouraging user code to convert a relative URL to an absolute TrustedURL might give user code a place to flag this, and would prevent directory traversal by the server, but network requests by browsers do not contain excess ".." path segments (modulo ), and IDL endpoints can do as good a job of this as user code and doing it in the IDL handlers could provide more context to heuristic intrusion detection systems.
from trusted-types.
This seems obsolete as types are just wrappers for strings, and the sinks perform the value normalization; please reopen if not.
from trusted-types.
Related Issues (20)
- Script element protection model HOT 2
- WPT for CSP header `trusted-types 'none' 'none'` missing HOT 9
- "Should Trusted Type policy creation be blocked by Content Security Policy?" passes "directive" instead of directive's name to "Create a violation object for global, policy, and directive"
- Spec / implementation mismatch with document.write/writeln HOT 8
- "Create a Trusted Type Policy" should specify the TypeError messages HOT 3
- Should SVGScriptElement have an IDL way to set a trusted script value? HOT 2
- Add WPTs for CSP `sandbox allow-scripts` combined with Trusted Types HOT 2
- Should all 3 script IDL setters change the associated script text value identically HOT 11
- Seeking Trusted Types feedback on Array.isTemplateObject HOT 5
- Finalise spec mechanism for event handlers HOT 8
- getPropertyType and SVGScriptElement href baseVal property HOT 2
- Script element mid-parse protection mechanism HOT 10
- Add WPTs for `report-uri` with Workers
- Add WPT that `createPolicy` which violates the `trusted-types` CSP directive fires a violation event for Windows (not Workers)
- Should the `trusted-types` CSP directive support the `report-sample` keyword? HOT 7
- Is "code updating a script before it finishes parsing" within the threat model of Trusted Types? HOT 4
- Should "Get Trusted Type compliant string" check `isHTML`/`isScript`/`isScriptURL`?
- Should the APIs for creating a TrustedScript etc return a frozen object? HOT 1
- Should the default policy be invoked when trusted types are not required? HOT 3
- Does the DOM spec really need to special case script elements for replaceChildren etc. HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from trusted-types.