diff options
| author | http://oneingray.myopenid.com/ <http://oneingray.myopenid.com/@web> | 2010-03-12 21:24:53 +0000 |
|---|---|---|
| committer | Joey Hess <joey@finch.kitenet.net> | 2010-03-12 21:24:53 +0000 |
| commit | b5e27e60ba38365f3e252df80c2a22503f00eb06 (patch) | |
| tree | 766510d7457180928822c34bf6aa75b40b1773b7 | |
| parent | 08485ec444cf81015e39c52e6ce8e7b933a036f6 (diff) | |
Note that <object /> still may be allowed, although in a form not suitable for, say, SVG inclusion.
| -rw-r--r-- | doc/todo/finer_control_over___60__object___47____62__s.mdwn | 34 |
1 files changed, 33 insertions, 1 deletions
diff --git a/doc/todo/finer_control_over___60__object___47____62__s.mdwn b/doc/todo/finer_control_over___60__object___47____62__s.mdwn index ac4b55568..c37d052db 100644 --- a/doc/todo/finer_control_over___60__object___47____62__s.mdwn +++ b/doc/todo/finer_control_over___60__object___47____62__s.mdwn @@ -27,13 +27,43 @@ For Ikiwiki, it may be nice to be able to restrict [URI's][URI] (as required by [[wishlist]] -> SVG can contain embedded javascript. The spec that you link to contains +> SVG can contain embedded javascript. + +>> Indeed. + +>> So, a more general tool (`XML::Scrubber`?) will be necessary to +>> refine both [XHTML][] and SVG. + +>> … And to leave [MathML][] as is (?.) + +>> — [[Ivan_Shmakov]], 2010-03-12Z. + +> The spec that you link to contains > examples of objects that contain python scripts, Microsoft OLE > objects, and Java. And then there's flash. I don't think ikiwiki can > assume all the possibilities are handled securely, particularly WRT XSS > attacks. > --[[Joey]] +>> I've scanned over all the `object` examples in the specification and +>> all of those that hold references to code (as opposed to data) have a +>> distinguishing `classid` attribute. + +>> While I won't assert that it's impossible to reference code with +>> `data` (and, thanks to `text/xhtml+xml` and `image/svg+xml`, it is +>> *not* impossible), throwing away any of the “insecure” +>> attributes listed above together with limiting the possible URI's +>> (i. e., only *local* and certain `data:` ones for `data` and +>> `usemap`) should make `object` almost as harmless as, say, `img`. + +>> (Though it certainly won't solve the [[SVG_problem|/todo/SVG]] being +>> restricted in such a way.) + +>> Of the remaining issues I could only think of recursive +>> `object` — the one that references its container document. + +>> — [[Ivan_Shmakov]], 2010-03-12Z. + ## See also * [Objects, Images, and Applets in HTML documents][objects-html] @@ -43,6 +73,8 @@ For Ikiwiki, it may be nice to be able to restrict [URI's][URI] (as required by * [Uniform Resource Identifier — the free encyclopedia][URI] [HTML::Scrubber]: http://search.cpan.org/~podmaster/HTML-Scrubber-0.08/Scrubber.pm +[MathML]: http://en.wikipedia.org/wiki/MathML [objects-html]: http://www.w3.org/TR/1999/REC-html401-19991224/struct/objects.html [RFC 2397]: http://tools.ietf.org/html/rfc2397 [URI]: http://en.wikipedia.org/wiki/Uniform_Resource_Identifier +[XHTML]: http://en.wikipedia.org/wiki/XHTML |