Timeline for Using iframes to sandbox untrusted code
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 22, 2012 at 2:44 | vote | accept | mgibsonbr | ||
| May 21, 2012 at 8:27 | history | edited | mgibsonbr | CC BY-SA 3.0 |
added 298 characters in body
|
| May 20, 2012 at 23:28 | answer | added | D.W. | timeline score: 13 | |
| May 20, 2012 at 8:30 | answer | added | user5575 | timeline score: 2 | |
| May 19, 2012 at 19:33 | history | edited | mgibsonbr | CC BY-SA 3.0 |
added 2169 characters in body
|
| May 19, 2012 at 18:35 | comment | added | mgibsonbr | The goal is a bit similar to what Google Wave did: provide a "generic" data model, persistence, communication, etc, while allowing third parties to build new things upon it. In principle the iframes were not meant to be invisible (so yes, they would provide HTML/JS/CSS) but I'm more inclined toward restricting extensions to the role of "controller" (which will render the view solely through my API). The problem I'm trying to solve is determine the viability of all this, and it boils down to the question: are there unforeseen consequences of having untrusted third party code running in iframes? | |
| May 19, 2012 at 14:30 | comment | added | Cyril N. | I agree with @LouisSomers, I don't get what you want to do exactly. In what will be made the view? Do you mean the third party will be able to have their own view (HTML/JS/CSS) in your website? | |
| May 19, 2012 at 11:15 | history | tweeted | twitter.com/#!/StackSecurity/status/203806026418495488 | ||
| May 19, 2012 at 9:50 | comment | added | Louis Somers | I'm having trouble understanding the problem. It sounds like it's all client-side code (javascript)? What are the third party "views" for if they are in invisible iframes? Is it to enrich data presented elsewhere on the page? Then why not do this on the server side where you'll have much more control? | |
| May 19, 2012 at 0:57 | history | asked | mgibsonbr | CC BY-SA 3.0 |