Put dormouseusercontent.com on the Public Suffix List, or settle the risk, by June 2027

Aperta
  • Qualcosa non va?
#1,581 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
38/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github, typescript
Ambito
devops, security

Direzione di ricerca

Start by reading the Public Suffix List guidelines and the linked security and Pocket app specs. By June 2027, check whether Dormouse serves thousands of users; if it does, follow the listed steps for an abuse contact page, PSL pull request, DNS TXT proof, phone verification, and spec updates. If it does not, measure the frame host’s cookie limit and either set a reasoned review date or update the specs to document acceptance of the risk.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

security

Deadline: June 2027.

The risk

On a phone, Pocket and one-time sessions show browser panes and Tools on subdomains of dormouseusercontent.com. Each frame gets its own subdomain, but browsers treat them all as one site for cookies, so a framed page can set a cookie for the whole domain. Until the domain is on the Public Suffix List:

  • Frames can pass values to each other. A cookie one framed page leaves can be read by another frame's page in the same browser, and a one-time link's frames share these cookies with Pocket's.
  • Frames can stop loading. Every frame request carries these cookies. If a page leaves more than the frame host accepts, frames fail to load on that phone until its cookies are cleared. We haven't measured where that limit is.

Each frame's bootstrap page already expires the cookies it can see before its page loads. That leaves a value a sibling sets later or on a deeper path, and the loading failure. No page's server sees these cookies, and the frame domain is separate from dormouse.sh, so a framed page can't set a cookie there. docs/specs/security.md -> "What is not defended" states this publicly.

Why it isn't done yet

The list's guidelines say projects not serving more than thousands of users are quite likely to be declined, and Dormouse doesn't meet that today. The other requirements are ready or nearly ready:

  • Registration: it runs to 2029-11-02. A PR needs more than two years remaining, so renew again if this gets submitted after about October 2027.
  • Contact: [email protected] meets the role-based address rule. It has to stay monitored, with replies within 30 days.
  • Abuse contact: use [email protected]. It is already on the Privacy, Terms, and Hosted pages, but no page yet says to report abuse there, and the PR must link to one that does.

How to close this

By June 2027, check whether Dormouse serves thousands of users, then take one of these paths.

If it does: get listed
  1. Add a line to a public page on dormouse.sh saying to report abuse to [email protected].
  2. Read the guidelines again, since they change. Open a PR on publicsuffix/list using its .github/pull_request_template.md unchanged, and add this to the PRIVATE section, sorted alphabetically by organization: 
    // DiffPlug LLC : https://dormouse.sh
// Submitted by Ned Twigg <[email protected]>
dormouseusercontent.com
  3. Add this DNS record with that PR's number, paste the dig output into the PR, and leave the record in place permanently: 
    _psl.dormouseusercontent.com. TXT "https://github.com/publicsuffix/list/pull/<PR NUMBER>"
  4. Once the entry has merged and current browsers carry it, check on a real iPhone and Android phone that a parent-domain cookie is refused on a live frame.
  5. Remove the entry from docs/specs/security.md, and update docs/specs/pocket-app.md -> the frame origins rule and the comment in lib/src/remote/frame-origin/bootstrap.ts. Close this citing that PR.
If it doesn't: settle it another way
  1. Measure what the frame host accepts, since that decides how real the loading failure is.
  2. Either set a new date in this issue with the reason, or accept the risk: reword docs/specs/security.md and docs/specs/pocket-app.md so they don't imply a listing is coming, and close this citing that PR.
Lingua principale
TypeScript
Stelle
5
Fork
1
Merge medio
11h 4m
PR unite (30g)
434

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di diffplug/dormouse

Tutte le issue di diffplug/dormouse

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.