11–20 of 69 posts
They serve user supplied JS from googledrive.com domain? Can it be done in a secure way?
What security issue are you thinking of? JavaScript doesn't run anything server-side...
Earlier quoted context omitted.
Dropbox also does that. You can potentially host your website within your 'Public' Dropbox folder. I'm sure Google is not using http://googledrive.com/ for anything that's user-identifiable. The only harm that I think can happen with JS is you being able to access/set any cookies/storage that are set by another 'public' site hosted on Google Drive that you've accessed earlier.
Dropbox shuts links down if you get any significant traffic.
They serve user supplied JS from googledrive.com domain? Can it be done in a secure way?
Dropbox also does that. You can potentially host your website within your 'Public' Dropbox folder. I'm sure Google is not using http://googledrive.com/ for anything that's user-identifiable. The only harm that I think can happen with JS is you being able to access/set any cookies/storage that are set by another 'public' site hosted on Google Drive that you've accessed earlier.
Earlier quoted context omitted.
Dropbox shuts links down if you get any significant traffic.
Really? Could you give more detail - at what level of traffic do they shut down links?
Looks like 20GB (free) or 200GB (paid) per day.
Is that an official Google page on how to do this, or a demo you put together that Google may nix shortly? I ask mainly because a DS_Store file is visible in the directory, which strikes me as not a typical Google thing. Do they even use Mac OS for anything?
Earlier quoted context omitted.
What security issue are you thinking of? JavaScript doesn't run anything server-side...
JavaScript can access any page and cookie from the same domain. So if I visited your googledrive.com hosted site, JavaScript from your site could potentially retrieve and send to you any other content on googledrive.com to which I have access.
Is that an official Google page on how to do this, or a demo you put together that Google may nix shortly? I ask mainly because a DS_Store file is visible in the directory, which strikes me as not a typical Google thing. Do they even use Mac OS for anything?
Macs are quite popular at Google, actually
Earlier quoted context omitted.
What security issue are you thinking of? JavaScript doesn't run anything server-side...
Being able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the malicious JS would be from the same origin, it's no longer cross-site, and gets a free pass around some of the browser's anti-XSS features.