benatkin 4 days ago

Blocking/allowlisting all JavaScript is the only way [1] to have a CSP fully contain an app (no exfiltration) [2] and with prefetch that might not be enough. The author is correct at the end to suggest using WebAssembly. (Also, it still has the issue of clicking links, which can be limited to certain domains or even data: by wrapping the untrusted code in an iframe and using child-src on the parent of the iframe)

1: https://github.com/w3c/webappsec/issues/656#issuecomment-246...

2: https://www.w3.org/TR/CSP3/#exfiltration

2
EE84M3i 3 days ago

I didn't realize you could use CSP for preventing exhilaration now! How did they close the WebRTC loopholes?

benatkin 3 days ago

They haven't. That in the spec stops short of actually saying that it will stop all exfiltration. What it will do is make it harder because you'd have to put the data in a subdomain or in a username/password. It also could make it hard to deny that an attempt to exfiltrate was deliberate.

kmeisthax 4 days ago

Why would WebAssembly provide more protection against exfiltration than JavaScript in this case?

benatkin 4 days ago

By default WebAssembly doesn't have access to the DOM or JavaScript globals. You have full control of how it can access these things.