Put dormouseusercontent.com on the Public Suffix List, or settle the risk, by June 2027

Aberta
  • Algo errado?
#1,581 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
38/100
Tipo de issue
Funcionalidade
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
github, typescript
Domínio
devops, security

Direção de pesquisa

Start by reading the Public Suffix List guidelines and the linked security and Pocket app specs. By June 2027, check whether Dormouse serves thousands of users; if it does, follow the listed steps for an abuse contact page, PSL pull request, DNS TXT proof, phone verification, and spec updates. If it does not, measure the frame host’s cookie limit and either set a reasoned review date or update the specs to document acceptance of the risk.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

security

Deadline: June 2027.

The risk

On a phone, Pocket and one-time sessions show browser panes and Tools on subdomains of dormouseusercontent.com. Each frame gets its own subdomain, but browsers treat them all as one site for cookies, so a framed page can set a cookie for the whole domain. Until the domain is on the Public Suffix List:

  • Frames can pass values to each other. A cookie one framed page leaves can be read by another frame's page in the same browser, and a one-time link's frames share these cookies with Pocket's.
  • Frames can stop loading. Every frame request carries these cookies. If a page leaves more than the frame host accepts, frames fail to load on that phone until its cookies are cleared. We haven't measured where that limit is.

Each frame's bootstrap page already expires the cookies it can see before its page loads. That leaves a value a sibling sets later or on a deeper path, and the loading failure. No page's server sees these cookies, and the frame domain is separate from dormouse.sh, so a framed page can't set a cookie there. docs/specs/security.md -> "What is not defended" states this publicly.

Why it isn't done yet

The list's guidelines say projects not serving more than thousands of users are quite likely to be declined, and Dormouse doesn't meet that today. The other requirements are ready or nearly ready:

  • Registration: it runs to 2029-11-02. A PR needs more than two years remaining, so renew again if this gets submitted after about October 2027.
  • Contact: [email protected] meets the role-based address rule. It has to stay monitored, with replies within 30 days.
  • Abuse contact: use [email protected]. It is already on the Privacy, Terms, and Hosted pages, but no page yet says to report abuse there, and the PR must link to one that does.

How to close this

By June 2027, check whether Dormouse serves thousands of users, then take one of these paths.

If it does: get listed
  1. Add a line to a public page on dormouse.sh saying to report abuse to [email protected].
  2. Read the guidelines again, since they change. Open a PR on publicsuffix/list using its .github/pull_request_template.md unchanged, and add this to the PRIVATE section, sorted alphabetically by organization: 
    // DiffPlug LLC : https://dormouse.sh
// Submitted by Ned Twigg <[email protected]>
dormouseusercontent.com
  3. Add this DNS record with that PR's number, paste the dig output into the PR, and leave the record in place permanently: 
    _psl.dormouseusercontent.com. TXT "https://github.com/publicsuffix/list/pull/<PR NUMBER>"
  4. Once the entry has merged and current browsers carry it, check on a real iPhone and Android phone that a parent-domain cookie is refused on a live frame.
  5. Remove the entry from docs/specs/security.md, and update docs/specs/pocket-app.md -> the frame origins rule and the comment in lib/src/remote/frame-origin/bootstrap.ts. Close this citing that PR.
If it doesn't: settle it another way
  1. Measure what the frame host accepts, since that decides how real the loading failure is.
  2. Either set a new date in this issue with the reason, or accept the risk: reword docs/specs/security.md and docs/specs/pocket-app.md so they don't imply a listing is coming, and close this citing that PR.
Linguagem predominante
TypeScript
Estrelas
5
Forks
1
Merge médio
11h 4min
PRs com merge (30d)
434

Preparar o ambiente

Este projeto não oferece contêiner de desenvolvimento, Dockerfile nem guia de contribuição, então a configuração fica por sua conta: comece pelo README e veja nosso guia da primeira contribuição para os passos gerais.

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de diffplug/dormouse

Todas as issues de diffplug/dormouse

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.