297
edits
Security/Reviews/SocialAPI: Difference between revisions
more formatting...
m (formatting) |
(more formatting...) |
||
| Line 185: | Line 185: | ||
* We create an iframe (for each provider) on the hidden window with the src attribute set to workerURL from the providers manifest. The content retrieved is copied and eval'd in the sandbox. Can code run in the hidden window, prior to being sandboxed? | * We create an iframe (for each provider) on the hidden window with the src attribute set to workerURL from the providers manifest. The content retrieved is copied and eval'd in the sandbox. Can code run in the hidden window, prior to being sandboxed? | ||
* The remote code is loaded into a sandboxed content iframe without access to chrome privileges or the hidden xul window. | * The remote code is loaded into a sandboxed content iframe without access to chrome privileges or the hidden xul window. | ||
* Not sure if this is part of the threat or remediation, I don't know enough about this part of firefox | ** Not sure if this is part of the threat or remediation, I don't know enough about this part of firefox | ||
Proposed Remediation | Proposed Remediation | ||
* ? | * ? | ||