Put dormouseusercontent.com on the Public Suffix List, or settle the risk, by June 2027

Ouverte
  • Quelque chose ne va pas ?
#1,581 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
38/100
Type d'issue
Fonctionnalité
Clarté
Clairement spécifiée
Activité
Active
Stack technique
github, typescript
Domaine
devops, security

Piste de recherche

Start by reading the Public Suffix List guidelines and the linked security and Pocket app specs. By June 2027, check whether Dormouse serves thousands of users; if it does, follow the listed steps for an abuse contact page, PSL pull request, DNS TXT proof, phone verification, and spec updates. If it does not, measure the frame host’s cookie limit and either set a reasoned review date or update the specs to document acceptance of the risk.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

security

Deadline: June 2027.

The risk

On a phone, Pocket and one-time sessions show browser panes and Tools on subdomains of dormouseusercontent.com. Each frame gets its own subdomain, but browsers treat them all as one site for cookies, so a framed page can set a cookie for the whole domain. Until the domain is on the Public Suffix List:

  • Frames can pass values to each other. A cookie one framed page leaves can be read by another frame's page in the same browser, and a one-time link's frames share these cookies with Pocket's.
  • Frames can stop loading. Every frame request carries these cookies. If a page leaves more than the frame host accepts, frames fail to load on that phone until its cookies are cleared. We haven't measured where that limit is.

Each frame's bootstrap page already expires the cookies it can see before its page loads. That leaves a value a sibling sets later or on a deeper path, and the loading failure. No page's server sees these cookies, and the frame domain is separate from dormouse.sh, so a framed page can't set a cookie there. docs/specs/security.md -> "What is not defended" states this publicly.

Why it isn't done yet

The list's guidelines say projects not serving more than thousands of users are quite likely to be declined, and Dormouse doesn't meet that today. The other requirements are ready or nearly ready:

  • Registration: it runs to 2029-11-02. A PR needs more than two years remaining, so renew again if this gets submitted after about October 2027.
  • Contact: [email protected] meets the role-based address rule. It has to stay monitored, with replies within 30 days.
  • Abuse contact: use [email protected]. It is already on the Privacy, Terms, and Hosted pages, but no page yet says to report abuse there, and the PR must link to one that does.

How to close this

By June 2027, check whether Dormouse serves thousands of users, then take one of these paths.

If it does: get listed
  1. Add a line to a public page on dormouse.sh saying to report abuse to [email protected].
  2. Read the guidelines again, since they change. Open a PR on publicsuffix/list using its .github/pull_request_template.md unchanged, and add this to the PRIVATE section, sorted alphabetically by organization: 
    // DiffPlug LLC : https://dormouse.sh
// Submitted by Ned Twigg <[email protected]>
dormouseusercontent.com
  3. Add this DNS record with that PR's number, paste the dig output into the PR, and leave the record in place permanently: 
    _psl.dormouseusercontent.com. TXT "https://github.com/publicsuffix/list/pull/<PR NUMBER>"
  4. Once the entry has merged and current browsers carry it, check on a real iPhone and Android phone that a parent-domain cookie is refused on a live frame.
  5. Remove the entry from docs/specs/security.md, and update docs/specs/pocket-app.md -> the frame origins rule and the comment in lib/src/remote/frame-origin/bootstrap.ts. Close this citing that PR.
If it doesn't: settle it another way
  1. Measure what the frame host accepts, since that decides how real the loading failure is.
  2. Either set a new date in this issue with the reason, or accept the risk: reword docs/specs/security.md and docs/specs/pocket-app.md so they don't imply a listing is coming, and close this citing that PR.
Langage dominant
TypeScript
Étoiles
5
Forks
1
Merge moyen
11 h 4 min
PR mergées (30 j)
434

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de diffplug/dormouse

Toutes les issues de diffplug/dormouse

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.