Live data from Hacker News

How I got XSS’d by my ad network

troyhunt.com

61–62 of 62 posts

Re: How I got XSS’d by my ad network

#61
post #54

Earlier quoted context omitted.

The integrity value is part of the script tag. You add a hash of the script content as a property of the script tag, and the browser only executes if it matches. I hacked together something that implements this sort of behavior in a script loader a while ago, if you're interested: https://github.com/ryancdotorg/VerifyJS

Ah I see, thanks for explaining. So, though this does allow one to safely circumvent the hosting cost associated with bigger third party scripts, it means giving up some of the advantages like dynamic updates (as the hash would now be incorrect), right? This would therefore not work when ad providers want to be able to supply content they get dynamically from others right?

Many of the CDNs will let you reference a specific version of the script. If you didn't do this, and there were an update, the script wouldn't load and you'd have to update your site. My script allows callbacks to be specified for a bad hash, so you could be notified of this, and the subresource integrity draft also mentions this as a good idea.

It seems not uncommon for ad networks to dynamically load further scripts/content, which would not fall under the hash. You can just sandbox them off in an iframe, though.

An obvious extension would be signed scripts, which would re-enable trusted updates of a script in a CDN, but there is the question of how that would be implemented.

Re: How I got XSS’d by my ad network

#62
post #48

Earlier quoted context omitted.

Which is an interesting problem as to stop loading all these scripts I have to give another script access to everything I see.

If you download the source for uBlock/uMatrix, and run locally you avoid the auto-updating of the add-on while being able to vet the source.

Thank you, that's an extremely good idea.
Post reply on HN