Consider the following scenario:
Alice wishes to browse Victor's website while on the job at Initech. Victor's website is hosted on an alternative domain name system to which Initech's DNS does not peer. Eve (wishing to facilitate the free and open exchange of knowledge) hosts a webpage containing JS that performs domain-name resolution and URL masking such that when Alice visits
victor.eve.tld an iFrame loads
victor.alt based off of the static IP address Victor has designated in the
victor.alt DNS record.
For seamless domain-name masking, Victor must place CORS authorization in the headers from his site to dance around the single origin policy. However, Victor suspects that Michael is trying to hack into Eve's web server and plant malicious JS into Eve's webpage (the parent of the iFrame). Victor wants verify that Michael has not modified the contents of the parent frame before he enables CORS authorization.
Victor has a copy of Eve's site and can include hashes of the material w/ out contacting Eve's server, so if he has read access, he can match the content. Micheal does not have access to Initech servers and connections from both sites are secured using TLS: assume that Micheal cannot carry out a man-in-the-middle attack.
Is it possible for an iFrame to verify the contents of the parent window:
- using any CORS configuration?
- while allowing read-only access?
- while limiting the the parent window's access to the content of the iFrame?
There are prior discussions regarding client-side JS verification from an untrusted cache (with a trusted connection, no MtM) but this situation requires validation by the material that is being fetched. There are also numerous posts regarding the use of iFrames to sandbox untrusted code. However, iFrame sand-boxing questions tend to revolve around a the parent window trusting the child, as does most of the external literature on the subject (frame-busting, etc).
Furthermore, Eve's server cannot actively participate in the process: she can only serve static HTML, JS, and CSS files. Victor cannot proxy information through Eve's server, he can only interact with his own or 3rd party servers.