Security Issues About HTML5 What Developers Need to Keep in Mind_html5 Tutorial Tips

Application security experts say HTML5 brings new security challenges to developers.
The war of words between Apple and Adobe has led to a lot of speculation about the fate of HTML 5. Although the implementation of HTML 5 still has a long way to go, one thing that is certain is that developers who use HTML 5 New security features will need to be deployed for the application security development lifecycle to address the security challenges posed by HTML5.
So what impact will HTML5 have on the attack surface we need to cover? This article will explore several important security issues about HTML 5.
　Client-side storage
Early versions of HTML only allowed websites to store cookies as local information, and these spaces were relatively small and only suitable for storing simple archive information or as storage in other locations. An identifier for the data, such as a session ID, said Dan Cornell, director of application security research at Denim Group. However, HTML5 LocalStorage allows the browser to store large databases locally, allowing new types of applications to be used.
"The attendant risk is that sensitive data may be stored on the local user's workstation, and an attacker who physically accesses or destroys the workstation can easily obtain the sensitive data," Cornell said, "This is particularly important when using shared computers. "By definition, it's really just the ability to store information on the client system," said Josh Abraham, a security researcher at Rapid7. "Then you have the potential for a client-side SQL injection attack." Potentially, or maybe one of your client's databases is malicious, and when synchronized with the production system, there may be synchronization issues, or the client's potentially malicious data will be inserted into the production system. ”
　To solve this problem. , developers need to be able to verify whether the data is malicious, which is actually a very complex problem.
Not everyone agrees on the importance of this issue. Chris Wysopal, chief technology officer at Veracode, said there have been many ways for web applications to store data client-side, such as through the use of plug-ins or browser extensions.
“There are many known ways to manipulate the HTML5 SessionStorage properties currently deployed, but this issue will not be resolved until the standard is finalized,” Wysopal said.
　
Cross-domain communication While other versions of HTML may allow JavaScript to issue XML HTTP requests back to the original server, HTML5 relaxes this restriction and XML HTTP requests can be sent to any server that allows this. The requested server. Of course, this can also cause serious security problems if the server cannot be trusted.
　“For example, I can build a mashup (a mashup that combines two or more web applications that use public or private databases to form an integrated application) to pull game scores from third-party websites through JSON (Javascript Object Notation),” Cornell said, "This website could send malicious data to an application that is running in my user's browser. Although HTML5 allows the creation of new types of applications, if developers do not understand these features when they start to use them, The security implications of the created application will bring great security risks to users. ”
For developers who write applications that rely on PostMessage(), they must carefully check to ensure that the information comes from the source. their own website, otherwise malicious code from other websites could create malicious messages, Wysopal added. This feature is not inherently secure, and developers have begun using different DOM (Document Object Model)/browser features to emulate cross-domain communication.
Another related issue is that the World Wide Web Consortium currently provides a way to bypass the same-origin policy using a similar cross-domain mechanism for cross-origin resource sharing designs.
“IE deploys different security features than Firefox, Chrome and Safari,” he noted. “Developers need to ensure they are harmed by creating access control lists that are too permissive, especially since some reference code is currently very insecure.
　
Iframe security 　From a security perspective, HTML5 also has good features, such as plans to support the sandbox attribute of iframes.
　"This attribute will allow developers to choose how the data is interpreted. "Unfortunately, like most HTML, this design is likely to be misunderstood by developers, and it is likely to be disabled by developers because it is inconvenient to use." If done correctly, this feature can help protect against malicious third-party ads or prevent the replay of untrustworthy content. ”