Put dormouseusercontent.com on the Public Suffix List, or settle the risk, by June 2027

未关闭
  • 哪里不对？
#1,581 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
38/100
Issue 类型
功能
描述清晰度
描述清楚
活跃度
活跃
技术栈
github, typescript
领域
devops, security

调研方向

Start by reading the Public Suffix List guidelines and the linked security and Pocket app specs. By June 2027, check whether Dormouse serves thousands of users; if it does, follow the listed steps for an abuse contact page, PSL pull request, DNS TXT proof, phone verification, and spec updates. If it does not, measure the frame host’s cookie limit and either set a reasoned review date or update the specs to document acceptance of the risk.

由索引模型根据 Issue 内容生成。

描述

security

Deadline: June 2027.

The risk

On a phone, Pocket and one-time sessions show browser panes and Tools on subdomains of dormouseusercontent.com. Each frame gets its own subdomain, but browsers treat them all as one site for cookies, so a framed page can set a cookie for the whole domain. Until the domain is on the Public Suffix List:

  • Frames can pass values to each other. A cookie one framed page leaves can be read by another frame's page in the same browser, and a one-time link's frames share these cookies with Pocket's.
  • Frames can stop loading. Every frame request carries these cookies. If a page leaves more than the frame host accepts, frames fail to load on that phone until its cookies are cleared. We haven't measured where that limit is.

Each frame's bootstrap page already expires the cookies it can see before its page loads. That leaves a value a sibling sets later or on a deeper path, and the loading failure. No page's server sees these cookies, and the frame domain is separate from dormouse.sh, so a framed page can't set a cookie there. docs/specs/security.md -> "What is not defended" states this publicly.

Why it isn't done yet

The list's guidelines say projects not serving more than thousands of users are quite likely to be declined, and Dormouse doesn't meet that today. The other requirements are ready or nearly ready:

  • Registration: it runs to 2029-11-02. A PR needs more than two years remaining, so renew again if this gets submitted after about October 2027.
  • Contact: [email protected] meets the role-based address rule. It has to stay monitored, with replies within 30 days.
  • Abuse contact: use [email protected]. It is already on the Privacy, Terms, and Hosted pages, but no page yet says to report abuse there, and the PR must link to one that does.

How to close this

By June 2027, check whether Dormouse serves thousands of users, then take one of these paths.

If it does: get listed
  1. Add a line to a public page on dormouse.sh saying to report abuse to [email protected].
  2. Read the guidelines again, since they change. Open a PR on publicsuffix/list using its .github/pull_request_template.md unchanged, and add this to the PRIVATE section, sorted alphabetically by organization: 
    // DiffPlug LLC : https://dormouse.sh
// Submitted by Ned Twigg <[email protected]>
dormouseusercontent.com
  3. Add this DNS record with that PR's number, paste the dig output into the PR, and leave the record in place permanently: 
    _psl.dormouseusercontent.com. TXT "https://github.com/publicsuffix/list/pull/<PR NUMBER>"
  4. Once the entry has merged and current browsers carry it, check on a real iPhone and Android phone that a parent-domain cookie is refused on a live frame.
  5. Remove the entry from docs/specs/security.md, and update docs/specs/pocket-app.md -> the frame origins rule and the comment in lib/src/remote/frame-origin/bootstrap.ts. Close this citing that PR.
If it doesn't: settle it another way
  1. Measure what the frame host accepts, since that decides how real the loading failure is.
  2. Either set a new date in this issue with the reason, or accept the risk: reword docs/specs/security.md and docs/specs/pocket-app.md so they don't imply a listing is coming, and close this citing that PR.
主要语言
TypeScript
星标
5
派生
1
平均合并
11 小时 4 分钟
30 天内合并 PR
434

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

diffplug/dormouse 的其他 Issue

查看 diffplug/dormouse 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。