Question

Our software manages libraries, museums, archives etc. We’d like to let the users (namely the catalogers, not the visitors) add some embedded content such as Google maps, YouTube videos etc. We’d like the solution to be as flexible as possible, as each embedded content provider has it’s own format. OTOH, we’d rather not allow the users to enter raw HTML, as this will impose both a XSS security risk and in case of erroneous HTML might screw up our surrounding web page.

I started looking into Google Maps today, and couldn’t find a way to handle it. I don’t want to let the users just copy the embedding HTML snippet into an item; I can’t embed the link URL provided, as Google won’t allow it; and I can’t let the user specify the coordinates, as I don’t want to use the Google Maps JS API (which means providing a built-in solution which we’ll have to maintain).

The question in not specifically about Google Maps, but Google Maps is quite representative. I’d love to hear suggestions for a flexible-yet-secure HTML embedding technique.

Thanks, Eran

Answer 1

Would Caja work for you?

Caja (pronounced ‘KA-ha’) is ‘virtual iframes’: it allows you to put untrusted third-party HTML and JavaScript inline in your page and still be secure. Caja

• gives stricter control over what the code can do:
  • no redirects to phishing pages: the window object the untrusted code has is a fake one created by the containing page
  • no malware: all requests to URLs are proxied
  • no XSS: dynamic HTML sanitization
• allows the untrusted code more power than is safe to give to code currently in iframes. Here are some possibilities:
  • floating frames (‘info windows’)
  • frames don’t have to be rectangular
  • frames can communicate without the current awkward protocols
  • a reader could broadcast geographic information about the current article; a maps gadget jumps to the location, while a news gadget gets local stories and a weather gadget pulls up the weather
  • similarly for financial info or entertainment info
  • an extensible syntax highlighter could have plugins that can mark up text but not leak the contents to another website
  • can be a bit channel (can only send information) or a code channel (can send functions)
  • hosting page can control who talks to whom