PhantomJS is a minimalistic, headless, WebKit-based, JavaScript-driven tool

Re:PhantomJS is a minimalistic, headless, WebKit-based, Java... by gojomo on Wednesday January 26, 2011 @02:26AM (#2142496)

Cool!

But, have security issues been considered?

It looks like a Javascript thread-of-execution that can write to local filesystem paths (to render graphics, at least) may call into network-loaded DOM/code. Is there any assurance that page contents can't discover and use phantom API operations? (Or perhaps read local 'file:' URIs?)

[ Parent | on HN ]

Re:PhantomJS is a minimalistic, headless, WebKit-based, Java... by kj12345 on Wednesday January 26, 2011 @12:09PM (#2143925)

Wow, that's a good insight, seems like a possible attack vector. Maybe something like Adobe Air's security model of putting local access and network access in different iframes with a message-passing API between them would work. That's always felt like a bit of a hack to me but at least the separation between different frames in WebKit has been well-tested.

[ Parent | on HN ]

Re:PhantomJS is a minimalistic, headless, WebKit-based, Java... by andrewf on Thursday January 27, 2011 @03:29AM (#2147119)

GreaseMonkey has to contend with these same issues. It has a security model, which will be broken if developers ignore the list of things you can't do.

http://wiki.greasespot.net/Security

[ Parent | on HN ]