-
Notifications
You must be signed in to change notification settings - Fork 61
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Consider security implications of URI schemes #2320
Comments
(See minutes of Gertjan's presentation: https://www.w3.org/publishing/groups/epub-wg/Meetings/Minutes/2022-06-03-epub) |
The issue was discussed in a meeting on 2022-06-17 List of resolutions:
View the transcript2. Consider security implications of URI schemes.See github issue epub-specs#2320. Dave Cramer: not sure what to do here because having a Ivan Herman: we might be getting into the same problem as with symlinks if we try to be precise about it. Matt Garrish: we made the change a few weeks back that remote resources should be referenced by HTTPS, for other URI schemes, they will probably spawn some other app (dialing app, mail client). Brady Duga: i think we've already fixed this. 1. URI schemes that are used internally - resolved with banning file: and HTTPS, 2. URI scheme that goes to another app. Ivan Herman: not sure that that 2nd part is in the spec yet. Brady Duga: okay, then let's recommend a 'hey, you're leaving our secure space now' to external links. Dave Cramer: i think informing user and getting consent is key here, not worrying about technical details. Matt Garrish: I don't recall this being in the spec. Ivan Herman: yes, we discussed this in a prior meeting. Matt Garrish: but not in the security section currently. Ivan Herman: is this going to be a SHOULD or a MUST?. Brady Duga: SHOULD. Preserves the ability for user consent to be subject to a global allow.
Ivan Herman: mgarrish can you find where we want to put this?. |
Placeholder to discuss this, as mentioned by Gertjen.
The text was updated successfully, but these errors were encountered: