Is it secure for pods to serve html files?

[josephguillaume]

@A_A

Regardless of my opinion on executable code on the pod, I think it is important to fix the current security issues even if there is no solution yet for executable code on the pod

As I use my own pod with apps I know well, I would see a solution that disables html files as a bug rather than a fix and would probably disable that feature fairly quickly I understand that organisations providing pods or apps would have a very different view on that.

@A_A

That could work if it’s done server side (on the pod) and for all executable code

I think best practice would be to have server side sanitation on write and client side sanitation on read. Similar ideas to what was described for the markdown renderer XSS in markdown renderer · Issue #369 · SolidOS/solid-panes · GitHub
Incidentally, best practice for sanitising markdown is to sanitise the html after it is produced.

@A_A

What are the advantages of running code on the pod, rather than on another server?

Dynamic panes in your built-in browser, direct use of web components, local add-ons as per the other thread, hosting apps yourself, not having to run a separate server

@A_A

I’m not sure I understand the relation of SolidOS to this thread

Publicly available html pages by themselves do not have access to any of your non public data unless you login. Opening a private html page while not logged in is prevented by requiring a dpop token (cookies aren’t sufficient)
The main attack vector for HTML pages is if the html page is rendered by the browser while you are logged in, which currently only really happens within SolidOS.

I’m not sure how you would exploit most of what you’re referring to without being logged in, which outside of solidos would require tricking somebody into it?