Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Datasette Apps: Host custom HTML applications inside Datasette

simonwillison.net

Post reply on HN
Print view View original

71–76 of 76 posts

Re: Datasette Apps: Host custom HTML applications inside Datasette

#71

Post by simonw »

cxr wrote: post #70
simonw wrote: post #61

Earlier quoted context omitted.

Right, which is why I'm combining it with - which really is designed to be used as a sandbox (if you can figure out the right way to implement it.)

> - which really is designed to be used as a sandbox Not for untrusted content living on the same origin to prevent it from exercising any of the powers that it would ordinarily have to be able to access sensitive data. It's a misleading name and shouldn't have been chosen. There is no combination of CSP or the iframe sandbox attribute that can be relied upon for that purpose. This is a fundamental limitation of the…

That's why I'm careful not to include allow-same-origin in the sandbox attribute - without that the iframe content is treated as a separate origin from the parent.

And I serve the content in srcdoc= to ensure there's no URL a user can visit which would directly execute the content outside of that iframe sandbox.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#72

Post by cxr »

simonw wrote: post #71
cxr wrote: post #70

Earlier quoted context omitted.

> - which really is designed to be used as a sandbox Not for untrusted content living on the same origin to prevent it from exercising any of the powers that it would ordinarily have to be able to access sensitive data. It's a misleading name and shouldn't have been chosen. There is no combination of CSP or the iframe sandbox attribute that can be relied upon for that purpose. This is a fundamental limitation of the…

That's why I'm careful not to include allow-same-origin in the sandbox attribute - without that the iframe content is treated as a separate origin from the parent. And I serve the content in srcdoc= to ensure there's no URL a user can visit which would directly execute the content outside of that iframe sandbox.

> That's why I'm careful not to include allow-same-origin in the sandbox attribute

It doesn't matter. I just said there is no combination of CSP or the iframe sandbox attribute that can be relied upon here.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#73

Post by simonw »

cxr wrote: post #72
simonw wrote: post #71

Earlier quoted context omitted.

That's why I'm careful not to include allow-same-origin in the sandbox attribute - without that the iframe content is treated as a separate origin from the parent. And I serve the content in srcdoc= to ensure there's no URL a user can visit which would directly execute the content outside of that iframe sandbox.

> That's why I'm careful not to include allow-same-origin in the sandbox attribute It doesn't matter. I just said there is no combination of CSP or the iframe sandbox attribute that can be relied upon here.

If that's true then my project is fatally flawed and I need to stop distributing it.

I'm not convinced it's true - I've been thinking about this for months, and building experimental prototypes to help me get to the combination that I think makes sense.

Can you describe an exploit that the combination I'm using of iframe sandbox= srcdoc= with an injected meta CSP tag doesn't handle?

Would moving the untrusted content to be served from a separate domain entirely close the hole?

(In case it's not clear the iframe sandbox= is the bit that's doing most of the work here - the CSP stuff is there mainly to protect against malicious apps that deliberately exfiltrate stolen private data.)

Re: Datasette Apps: Host custom HTML applications inside Datasette

#74

Post by Trialog »

AIcanbiteme wrote: post #69

How does this work, does some mechanism replace the actual tape drive in the Datasette? Can you just use the tape port with the gadget or does it somehow need the tape drive? How do you access the HTML applications, how is the translation to PETSCII handled? I have no idea how this could work but as a long time Commodore 64 fan I'm interested. The link won't load for me, sadly. Can somebody give me a quick rundown on…

[dead]

Re: Datasette Apps: Host custom HTML applications inside Datasette

#75

Post by cxr »

simonw wrote: post #73
cxr wrote: post #72

Earlier quoted context omitted.

> That's why I'm careful not to include allow-same-origin in the sandbox attribute It doesn't matter. I just said there is no combination of CSP or the iframe sandbox attribute that can be relied upon here.

If that's true then my project is fatally flawed and I need to stop distributing it. I'm not convinced it's true - I've been thinking about this for months, and building experimental prototypes to help me get to the combination that I think makes sense. Can you describe an exploit that the combination I'm using of iframe sandbox= srcdoc= with an injected meta CSP tag doesn't handle? Would moving the untrusted content…

> Would moving the untrusted content to be served from a separate domain entirely close the hole?

Yes.

Re: Datasette Apps: Host custom HTML applications inside Datasette

#76

Post by anitil »

e12e wrote: post #38
anitil wrote: post #6

When I've needed something like this in the past I've spun up simple HTML pages and used the json endpoint that all datasette instances come with [0]. I like this new pattern much better, as it keeps your app and data in one place (I remember having some issue with this at the time, though I can't remember what the actual issue was) So I imagine we could now load some data in to sqlite, design some HTML also loaded i…

> it keeps your app and data in one place (I remember having some issue with this at the time, though I can't remember what the actual issue was) CORS headers?

I think you might be right, that rings a bell. There's an item on the front page about this right now, and I'm guilty as charged - I don't understand CORS at all

https://news.ycombinator.com/item?id=48614844

Post reply on HN