Are off the shelf CSP alternatives like Ensighten used by BritishAirways any good/safe? As and example, the way the bootstrap script seems to work is to bind its own proxy methods to XMLHttpRequest Open/Send which then check the requested domain against the list of allowed domains. Anything attempting to talk to unapproved domains get a fake response. Is this approach as safe as CSP? Is it possible for any scripts to remove Ensighten's bindings and set it back to native code?

  • As an example check window.XMLHttpRequest.prototype.send on britishairways site and its no longer native code but is bound to a proxy method – Display name Oct 17 '19 at 19:31

It's definitely not as safe as a CSP. All you would need to do is create an empty iframe and you can get a full set of unmodified globals from that iframe's window object.

Without a CSP, it would also be relatively easy to send data out to another domain using GET parameters in the src of an img tag for example. You could also use a form to send POST data via JavaScript (using an iframe you can even avoid a redirect).

| improve this answer | |
  • The XMLHttpRequest was just an example. All resources are checked for approved domains and the rest of the URL for any restricted data being sent irrespective of the HttpRequest method. – Display name Oct 17 '19 at 21:39
  • 1
    @Displayname Globals patching cannot prevent you from creating an img tag with an arbitrary src to my knowledge. – Alexander O'Mara Oct 17 '19 at 22:28
  • As far as I know they override the creation of new elements on the page too. Thereby messing around with the src URL. – Display name Oct 18 '19 at 12:33
  • 1
    @Displayname It does not appear to, and I'm not sure it would even be possible (innerHTML can be used to parse HTML, bypassing any hijacking new element creation). I was successfully able to create an image tag that made an external request on the britishairways website using the following. var img=document.createElement('img');img.src='https://example.com/';document.body.appendChild(img); – Alexander O'Mara Oct 18 '19 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.