Put dormouseusercontent.com on the Public Suffix List, or settle the risk, by June 2027

オープン
  • 何か問題がありますか？
#1,581 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
38/100
issue の種類
機能追加
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github, typescript
領域
devops, security

調査の方向性

Start by reading the Public Suffix List guidelines and the linked security and Pocket app specs. By June 2027, check whether Dormouse serves thousands of users; if it does, follow the listed steps for an abuse contact page, PSL pull request, DNS TXT proof, phone verification, and spec updates. If it does not, measure the frame host’s cookie limit and either set a reasoned review date or update the specs to document acceptance of the risk.

索引モデルが issue の本文から書いたものです。

説明

security

Deadline: June 2027.

The risk

On a phone, Pocket and one-time sessions show browser panes and Tools on subdomains of dormouseusercontent.com. Each frame gets its own subdomain, but browsers treat them all as one site for cookies, so a framed page can set a cookie for the whole domain. Until the domain is on the Public Suffix List:

  • Frames can pass values to each other. A cookie one framed page leaves can be read by another frame's page in the same browser, and a one-time link's frames share these cookies with Pocket's.
  • Frames can stop loading. Every frame request carries these cookies. If a page leaves more than the frame host accepts, frames fail to load on that phone until its cookies are cleared. We haven't measured where that limit is.

Each frame's bootstrap page already expires the cookies it can see before its page loads. That leaves a value a sibling sets later or on a deeper path, and the loading failure. No page's server sees these cookies, and the frame domain is separate from dormouse.sh, so a framed page can't set a cookie there. docs/specs/security.md -> "What is not defended" states this publicly.

Why it isn't done yet

The list's guidelines say projects not serving more than thousands of users are quite likely to be declined, and Dormouse doesn't meet that today. The other requirements are ready or nearly ready:

  • Registration: it runs to 2029-11-02. A PR needs more than two years remaining, so renew again if this gets submitted after about October 2027.
  • Contact: [email protected] meets the role-based address rule. It has to stay monitored, with replies within 30 days.
  • Abuse contact: use [email protected]. It is already on the Privacy, Terms, and Hosted pages, but no page yet says to report abuse there, and the PR must link to one that does.

How to close this

By June 2027, check whether Dormouse serves thousands of users, then take one of these paths.

If it does: get listed
  1. Add a line to a public page on dormouse.sh saying to report abuse to [email protected].
  2. Read the guidelines again, since they change. Open a PR on publicsuffix/list using its .github/pull_request_template.md unchanged, and add this to the PRIVATE section, sorted alphabetically by organization: 
    // DiffPlug LLC : https://dormouse.sh
// Submitted by Ned Twigg <[email protected]>
dormouseusercontent.com
  3. Add this DNS record with that PR's number, paste the dig output into the PR, and leave the record in place permanently: 
    _psl.dormouseusercontent.com. TXT "https://github.com/publicsuffix/list/pull/<PR NUMBER>"
  4. Once the entry has merged and current browsers carry it, check on a real iPhone and Android phone that a parent-domain cookie is refused on a live frame.
  5. Remove the entry from docs/specs/security.md, and update docs/specs/pocket-app.md -> the frame origins rule and the comment in lib/src/remote/frame-origin/bootstrap.ts. Close this citing that PR.
If it doesn't: settle it another way
  1. Measure what the frame host accepts, since that decides how real the loading failure is.
  2. Either set a new date in this issue with the reason, or accept the risk: reword docs/specs/security.md and docs/specs/pocket-app.md so they don't imply a listing is coming, and close this citing that PR.
主要言語
TypeScript
スター
5
フォーク
1
平均マージ
11時間 4分
マージ済み PR（30日）
434

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

diffplug/dormouse のほかの issue

diffplug/dormouse の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。