Re: CSP (Content Security Policy) and Squirrelmail
Paul Lesniewski <[email protected]> Mon, 12 Sep 2011 22:07:44 -0700
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <CAHog117XKcyM431o-nVo-vpBEmFk_GgDcAbdQbspYYr30igJeA@mail.gmail.com> |
On Tue, Sep 6, 2011 at 5:41 AM, Alexandros Vellis <[email protected]> wrote: > There is a new method for providing an extra layer of security against > XSS, which uses a set of HTTP headers to provide content restrictions > and policy directives. > > http://people.mozilla.com/~bsterne/content-security-policy/index.html > https://wiki.mozilla.org/Security/CSP/Design_Considerations > https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html > > For something like this to apply in squirrelmail, there is a need for > inline javascripts to be moved away from HTML pages and into separate > javascript-only files. > > In my opinion it is worth the effort. It'd be nice to think we could wash away all our XSS fears and problems with a solution like this, but we'd still need to stay on top of things for those using browsers without such support. Additionally, "the effort" may or may not be substantial. We'd need to keep in mind that many plugins are only able to do what they do because of the ability to inject inline JavaScript. There are probably some ways around this (require all plugins to add script tags in the page header and add a hook for the onload event they can add to or the likes, but I can imagine this being fairly problematic in more than a few cases. It'd be interesting to play with, but would need to be configurable so admins can turn it off to be able to use incompatible plugins, etc. -- Paul Lesniewski SquirrelMail Team Please support Open Source Software by donating to SquirrelMail! http://squirrelmail.org/donate_paul_lesniewski.php ------------------------------------------------------------------------------ BlackBerry® DevCon Americas, Oct. 18-20, San Francisco, CA Learn about the latest advances in developing for the BlackBerry® mobile platform with sessions, labs & more. See new tools and technologies. Register for BlackBerry® DevCon today! http://p.sf.net/sfu/rim-devcon-copy1 ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: [email protected] List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel