HTML5 Sandbox - a bad idea

Re:HTML5 Sandbox - a bad idea by homakov on Saturday April 06, 2013 @02:11AM (#5502804)

exactly, and vk.com (biggest social network in europe) is a showcase. They use such framebreaker:

   if (parent && parent != window && (browser.msie || browser.opera || browser.mozilla || browser.chrome || browser.safari || browser.iphone)) {
      document.getElementsByTagName('body')[0].innerHTML = '';
    }

It cannot be bypassed with NoContent trick by the way. Because it removes body, not navigates the parent

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by tptacek on Saturday April 06, 2013 @09:41AM (#5503548)

Isn't that exactly the kind of framebuster Boneh says doesn't work?

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by homakov on Saturday April 06, 2013 @10:42AM (#5503688)

I don't think so, what bypasses this one? (besides sandbox and XSS Auditor trick)

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by tptacek on Saturday April 06, 2013 @02:01PM (#5504381)

Read the paper I posted up thread.

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by homakov on Saturday April 06, 2013 @02:38PM (#5504528)

Table 2: Frame busting conditional statement

we consider following tricks:

document.write('')

setTimeout(function(){document.body.innerHTML='';},1);

window.self.onload = function(evt){document.body.innerHTML='';}

None of them was bypassed further in the paper. (I used Ctrl+F)

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by homakov on Saturday April 06, 2013 @02:34PM (#5504511)

double checked http://seclab.stanford.edu/websec/framebusting/framebust.pdf there are many parent-navigation bypasses in this paper but nothing for innerHTML='' (not taking into account sandbox and xss auditor)

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by esailija on Saturday April 06, 2013 @11:29AM (#5503854)

What are the browser checks for?

[ Parent | on HN ]