Alex Gleason
be65c659b2
Derive private iframe.diy subdomains with HMAC-SHA256
...
The i-tag UUID used for webxdc coordination is attacker-controlled.
Using it directly as the iframe.diy subdomain lets a malicious event
author pick a subdomain that collides with another app's origin,
gaining access to its localStorage/IndexedDB.
Introduce a persistent random seed in localStorage (ditto:seed) and
derive the subdomain as base36(HMAC-SHA256(seed, prefix|identifier)).
The prefix (e.g. "webxdc") domain-separates different use-cases.
The subdomain is stable per device+app but unpredictable to event
authors.
2026-04-06 00:33:55 -05:00
..
2026-04-02 07:48:14 -05:00
2026-04-05 14:23:58 -05:00
2026-03-27 17:46:16 -05:00
2026-03-30 06:21:50 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-03-13 21:14:03 -05:00
2026-03-17 19:55:18 +00:00
2026-03-20 19:14:13 -05:00
2026-04-03 18:10:22 -05:00
2026-04-01 23:16:33 -05:00
2026-03-24 09:02:57 -05:00
2026-03-22 15:39:01 -05:00
2026-03-25 13:37:02 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-03-16 03:55:21 -05:00
2026-03-20 22:51:01 -05:00
2026-03-21 01:16:50 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-03-31 06:48:36 -05:00
2026-04-01 19:14:01 -05:00
2026-03-17 19:55:18 +00:00
2026-03-23 21:57:22 -05:00
2026-03-22 23:32:25 -05:00
2026-03-03 10:25:57 -06:00
2026-03-03 09:35:00 -05:00
2026-03-13 21:14:03 -05:00
2026-04-05 11:57:31 -05:00
2026-04-04 06:03:33 -05:00
2026-04-05 11:57:31 -05:00
2026-03-13 21:14:03 -05:00
2026-04-05 10:27:43 -05:00
2026-04-05 11:57:31 -05:00
2026-03-01 22:15:47 -06:00
2026-03-23 00:21:02 -05:00
2026-02-28 04:02:53 -06:00
2026-04-04 22:58:42 -05:00
2026-03-28 21:25:58 -05:00
2026-03-16 01:39:56 -05:00
2026-03-07 14:26:12 -06:00
2026-03-22 01:48:13 +00:00
2026-03-27 15:54:20 -03:00
2026-04-05 11:57:31 -05:00
2026-03-31 16:32:27 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 14:23:58 -05:00
2026-03-28 23:07:21 -07:00
2026-04-04 22:58:42 -05:00
2026-04-01 12:56:23 -05:00
2026-03-25 00:26:07 -05:00
2026-03-03 17:25:14 -06:00
2026-04-03 16:20:40 -05:00
2026-03-25 20:10:40 -05:00
2026-02-21 15:14:30 -06:00
2026-03-23 21:57:22 -05:00
2026-03-23 21:46:14 -05:00
2026-03-26 16:51:31 -05:00
2026-04-03 16:50:17 -05:00
2026-04-05 11:57:31 -05:00
2026-03-17 09:29:50 -05:00
2026-03-16 03:55:21 -05:00
2026-03-27 20:56:36 -05:00
2026-03-17 00:29:01 +00:00
2026-03-15 02:44:43 -05:00
2026-03-23 15:31:05 -05:00
2026-04-05 06:01:48 -05:00
2026-03-27 23:43:46 -05:00
2026-03-28 12:44:28 -05:00
2026-02-23 00:57:42 -06:00
2026-03-18 04:00:25 -05:00
2026-03-17 19:55:18 +00:00
2026-03-28 21:25:58 -05:00
2026-04-05 11:57:31 -05:00
2026-03-07 19:47:52 -06:00
2026-03-07 19:58:29 -06:00
2026-03-03 07:31:06 -06:00
2026-04-03 23:27:53 -05:00
2026-04-05 14:23:58 -05:00
2026-04-05 11:07:55 -05:00
2026-02-26 22:13:54 -06:00
2026-03-28 05:13:21 -05:00
2026-03-20 01:39:05 -05:00
2026-04-05 06:01:48 -05:00
2026-03-23 21:57:22 -05:00
2026-04-05 08:27:37 -05:00
2026-03-22 14:04:26 -05:00
2026-03-17 19:55:18 +00:00
2026-03-24 21:06:13 -05:00
2026-03-03 06:32:10 -06:00
2026-02-22 02:38:29 -06:00
2026-04-03 17:30:00 -05:00
2026-03-02 00:46:47 -06:00
2026-04-05 11:57:31 -05:00
2026-03-13 21:14:03 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-03-24 16:10:35 -05:00
2026-04-05 08:09:21 -05:00
2026-03-30 09:56:02 -05:00
2026-03-28 09:39:09 -05:00
2026-04-05 11:57:31 -05:00
2026-02-21 04:10:50 -06:00
2026-03-21 22:23:53 -05:00
2026-02-19 10:40:38 -06:00
2026-03-03 07:33:05 -06:00
2026-03-25 20:10:40 -05:00
2026-04-02 23:09:01 -05:00
2026-04-05 06:55:05 -05:00
2026-04-05 15:12:19 -05:00
2026-02-20 15:20:18 -06:00
2026-04-02 03:50:50 -05:00
2026-03-16 03:55:21 -05:00
2026-04-01 02:47:24 -05:00
2026-04-03 18:37:28 -05:00
2026-04-03 18:37:28 -05:00
2026-03-28 05:39:48 -05:00
2026-03-28 21:25:58 -05:00
2026-03-22 23:32:25 -05:00
2026-03-31 06:48:36 -05:00
2026-03-11 14:35:47 -05:00
2026-04-05 11:57:31 -05:00
2026-04-04 03:23:39 -05:00
2026-03-31 07:37:44 -05:00
2026-03-19 14:54:51 -05:00
2026-04-05 11:57:31 -05:00
2026-03-27 15:54:20 -03:00
2026-03-29 14:37:46 -05:00
2026-03-30 11:06:32 -05:00
2026-03-21 20:55:05 -05:00
2026-04-05 11:57:31 -05:00
2026-03-30 09:56:02 -05:00
2026-04-05 11:57:31 -05:00
2026-03-05 22:53:44 -06:00
2026-03-28 21:25:58 -05:00
2026-02-18 04:00:44 -06:00
2026-04-04 22:58:42 -05:00
2026-04-02 03:50:50 -05:00
2026-02-28 20:14:38 -06:00
2026-03-24 10:43:25 +03:00
2026-04-05 11:57:31 -05:00
2026-04-04 06:03:33 -05:00
2026-03-03 16:31:41 -05:00
2026-03-15 04:26:09 -05:00
2026-03-18 03:20:55 -05:00
2026-03-25 18:32:36 -05:00
2026-03-13 21:14:03 -05:00
2026-04-05 11:57:31 -05:00
2026-02-25 22:46:27 -06:00
2026-02-16 16:54:01 -06:00
2026-03-03 17:25:14 -06:00
2026-03-25 20:10:40 -05:00
2026-03-25 18:32:36 -05:00
2026-03-28 07:47:26 -05:00
2026-04-01 02:37:27 -05:00
2026-02-28 20:14:38 -06:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-04-05 11:57:31 -05:00
2026-03-29 06:54:58 -05:00
2026-03-13 21:14:03 -05:00
2026-03-28 00:29:37 -05:00
2026-04-05 11:57:31 -05:00
2026-03-13 21:14:03 -05:00
2026-04-05 09:50:52 -05:00
2026-03-28 06:27:21 -05:00
2026-03-21 22:39:13 -05:00
2026-04-02 03:01:32 -05:00
2026-04-05 11:57:31 -05:00
2026-03-16 03:55:21 -05:00
2026-03-07 20:14:17 -06:00
2026-03-17 23:56:57 +07:00
2026-04-05 23:20:21 -05:00
2026-04-06 00:33:55 -05:00
2026-02-27 19:33:18 -06:00
2026-03-14 05:59:03 +00:00
2026-03-28 21:25:58 -05:00
2026-04-03 16:20:40 -05:00
2026-04-03 17:45:36 -05:00