Timeline for Protection against XSS using a tiny virtual-machine in browser
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 14, 2015 at 20:08 | comment | added | Olle Härstedt | Yeah, but the problem in this case arises in a certain setting, namely when there are more than one admin user. I think the framework should offer a possibility to handle this scenario safely. Thanks for your feedback! | |
| Oct 14, 2015 at 18:01 | comment | added | svidgen | I can update my answer if it help; but, for on-premise applications that the customer customizes, it's perfectly acceptable to leave XSS concerns on their customizations in their hands. Bear in mind that many very expensive, very robust products are stable and secure out-of-the-box, but the customer is responsible for security issues that they introduce through their own processes, mismanagement, and customizations. | |
| Oct 14, 2015 at 17:38 | comment | added | Olle Härstedt | Both. It's an open-source PHP web-application, but you can buy support and hosting for it. | |
| Oct 14, 2015 at 15:02 | comment | added | svidgen | @OlleHärstedt Not sure I understand the "additional architecture" comment. ... Is this an individually/locally deployed (on-premise) app? | |
| Oct 14, 2015 at 14:59 | comment | added | Olle Härstedt | That depends, a small VM might not be such a big project. Here's one in Ruby in 150 LOC: github.com/txus/microvm Additional architectural dependencies is not an option because of the user-base. I will investigate the possibility to run scripts elsewhere, but it depends on how much they need to interact with other stuff. | |
| Oct 14, 2015 at 14:55 | history | edited | svidgen | CC BY-SA 3.0 |
added 151 characters in body
|
| Oct 14, 2015 at 14:47 | history | answered | svidgen | CC BY-SA 3.0 |