Skip to content
This repository has been archived by the owner on Feb 26, 2020. It is now read-only.

Parity UI should not allow browsing to arbitrary websites #118

Closed
peterjoel opened this issue May 23, 2018 · 4 comments
Closed

Parity UI should not allow browsing to arbitrary websites #118

peterjoel opened this issue May 23, 2018 · 4 comments
Assignees
@axelchalon
Labels
F1-security The client fails to follow expected, security-sensitive, behaviour. P7-nicetohave Issue is worth doing eventually. Z7-duplicate Issue is a duplicate. Closer should comment with a link to the duplicate.

Comments

@peterjoel
Copy link

Inside Parity UI there are links to blogs and external resources. Any of these can have links to arbitrary websites. Having 3rd party websites load inside the UI presents the risk that a site could attempt a phishing attack simulating the wallet DApp, or make a signing request.

The web browser inside Parity UI should be restricted to a very limited whitelist of domains. All other pages should open in your default browser.

I'm running:

  • Parity UI version: 0.2.4
  • Which Parity version?: 1.10.5
  • Which operating system?: MacOS
  • How installed?: via installer
  • Are you fully synchronized?: yes
  • Which network are you connected to?: ethereum
  • Did you try to restart the node?: no
@amaury1093
Copy link
Contributor

Agreed. Related to #111.

@Tbaut Tbaut added F1-security The client fails to follow expected, security-sensitive, behaviour. Z7-duplicate Issue is a duplicate. Closer should comment with a link to the duplicate. P7-nicetohave Issue is worth doing eventually. labels May 24, 2018
@Tbaut
Copy link
Contributor

Tbaut commented May 24, 2018

Close for duplication

@Tbaut Tbaut closed this as completed May 24, 2018
@axelchalon axelchalon reopened this May 25, 2018
@axelchalon axelchalon self-assigned this May 25, 2018
@axelchalon
Copy link
Contributor

axelchalon commented May 25, 2018 •
edited
Loading

I think this issue is specific to the links in the news displayed in the wallet dapp. I'll fix this for dapp-wallet.

@axelchalon axelchalon mentioned this issue May 25, 2018
Merged
@amaury1093
Copy link
Contributor

@axelchalon How about if a 3rd-party network dapp decides to put <a href="google.com">. The dapp will still navigate to google.

Probably something needs to be done on the Electron side too.

@axelchalon axelchalon reopened this Jun 24, 2018
@axelchalon axelchalon added the A3-inprogress Pull request is in progress. No review needed at this stage. label Jun 24, 2018
@axelchalon axelchalon mentioned this issue Jun 25, 2018
Merged
@axelchalon axelchalon removed the A3-inprogress Pull request is in progress. No review needed at this stage. label Jul 3, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@axelchalon axelchalon

Labels
F1-security The client fails to follow expected, security-sensitive, behaviour. P7-nicetohave Issue is worth doing eventually. Z7-duplicate Issue is a duplicate. Closer should comment with a link to the duplicate.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@peterjoel @amaury1093 @axelchalon @Tbaut