Prevent possible phishing from misuse of ipfs gateway #52
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
brian-lc
approved these changes
Jan 24, 2019
|
We might want to consider running a scan against the final site to see if there are any other exploits that could be an issue. |
|
Know any good open source tools?
Sense it's all static, wouldn't most exploits be from the Dev, not the
platform?
What exploits are you thinking of? Any in particular?
…On Thu, Jan 24, 2019 at 5:31 PM Brian Chamberlain ***@***.***> wrote:
We might want to consider running a scan against the final site to see if
there are any other exploits that could be an issue.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#52 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AFgLF428Qin2kmuuTYkvUPrk6AsWVGkFks5vGjRVgaJpZM4aRfzn>
.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related Issue
Supports #45
Related PRs
This PR is not dependent on any other PR
What does this PR do?
I realized that allowing any domain to forward to any arbitrary ipfs hash could lead to weird cookie things or phishing if a site were vulnerable to XSS. I'm preventing that.
Description of Changes
Modified the viewer request where the bug was.
I was balancing between two concerns with this one. I think it would be cool if a site could work on a normal ipfs gateway, at which point sites could have links to their own content. So I allowed that to work as it seems safe.
I'd be curious if there are opposing thoughts.
What gif most accurately describes how I feel towards this PR?
