Comments (5)
"CSS sanitization logic that is trustworthy" seems the same as ShadowDOM but when its cross-origin you have more control over the sanitization. There is also meltdown+spectre concerns to leak information since its all in the same process.
"first to run overpowers others" does also apply to content scripts (if you own them) but yeah a normal web app
is better to protect from.
"code running before LavaDome is out of its threat-model" for browser extensions it is possible to deny them from accessing a host even if they ask for <all_urls>
this is with a feature called runtime_blocked_hosts
https://support.google.com/chrome/a/answer/9867568 but it does require a policy to be set people can opt-in to this protection if they want to.
from lavadome.
(() => {
let frame = document.createElement('iframe');
frame.sandbox = '';
document.body.appendChild(frame);
frame.contentWindow.location = 'data:text/html,This is a secret!';
})();
I don't really get what's so hard about using an iframe
from lavadome.
Like the ShadowDom could just use an iframe internally :)
Needed CSS can be passed in, after its checked to be safe from leaks.
from lavadome.
Thank you for engaging with this project @NDevTK. A couple of points:
Unlike the background worker, content scripts should not be exposed to sensitive information.
That's not true really.
Not only that they should according to the most basic rules in runtime security ("first to run overpowers others" and "extensions, whether background or content-scripts, are superior to app context"), but also that there's nothing that can be done about it with current state of the web. If you execute JS code before LavaDome, whether as content script or as just plain JS in the app, you always have the power to compromise LavaDome and there's nothing we can do about it (as we learned over and over with Snow with which you are very familiar).
Therefore, code running before LavaDome is out of its threat-model scope by definition. We make that very clear in the README.
"One use case for such a feature is MetaMask's "show private key" toggle, which exports the private key into plaintext upon user request." this is from a browser extension right? so can just use the API.
Not exactly.
Yes, MetaMask is an extension, but LavaDome is deployed within the web app of MetaMask itself, and not into web pages the MetaMask extension has access to. Therefore, the openOrClosedShadowRoot
API cannot be used against how MetaMask deploys LavaDome.
In contrast to this, if a normal web app decides to deploy LavaDome, installed extensions can compromise LavaDome using the openOrClosedShadowRoot
API.
Again, according to the threat model, that's possible by definition. LavaDome can't do anything about it, and therefore won't try.
If I ever encounter an example for successfully defending hermetically against all types of attack attempts carried by code running BEFORE the defender - I will admit to be wrong, and this will change how runtime security is handled and perceived DRAMATICALLY (cc @SMotaal).
"I don't really get what's so hard about using an iframe"
Against content scripts? Or same-privileged entities within the app? Not sure which one you mean so I'll address both:
With content scripts, this approach is not superior to ShadowDOM in any way, because again - they can run code before LavaDome that easily undermines it (whether by tapping into createElement
, 'appendChild`, or anything else).
Also, extensions can instruct the browser to load their content script within every new realm, so the "sandbox" attribute won't really save you here from extensions.
With same-privileged entities within the app, you are not wrong. An iframe can introduce security and it was considered carefully when initiating this project (and still is).
The problem with iframes however, is that they make it harder (not impossible) to integrate generically into apps while maintaining the same level of UI/UX as opposed to ShadowDOMs.
"Needed CSS can be passed in, after its checked to be safe from leaks."
This is what I'm talking about. This isn't something simple to do. Expecting others to adopt LavaDome is far harder when they have to provide CSS to make the app behave as smoothly as without it, especially if LavaDome introduces text that runs within a separate realm (iframe).
To this complexity, add the need for LavaDome to introduce CSS sanitization logic that is trustworthy which would probably require us to maintain continently.
This makes iframes far less desirable as the tool for the job IMO. You can find more information about this in the README.
I made sure to address your input entirely and with details, I hope this helps.
from lavadome.
Fair point. I still think using iframes would be far harder. Might get convinced one day in the future.
Closing for now (feel free to reopen if needed)
from lavadome.
Related Issues (18)
- Support React framework HOT 1
- LavaDome is vulnerable to selection API HOT 2
- LavaDome is vulnerable to font-face based leak attack HOT 1
- Audit defensive coding HOT 2
- Make demo great HOT 1
- LavaDome bypass via text fragments HOT 11
- LavaDome bypass via Screen Capture API HOT 1
- LavaDome is vulnerable to onmouseover HOT 1
- LavaDome bypass via overridden built-in methods HOT 2
- Add tests
- LavaDome bypass via font ligatures HOT 13
- Refuse to load LavaDome within non-top documents HOT 1
- Support copy to clipboard
- LavaDome bypass by detecting character height HOT 5
- AI generated logo wanted
- Add release-and-publish GHA CI workflows
- Safari support HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from lavadome.