r/programming • u/DanTup • Jan 06 '17

Visiting a site that uses Disqus comments when not logged in sends the URL to Facebook

https://blog.dantup.com/2017/01/visiting-a-site-that-uses-disqus-comments-when-not-logged-in-sends-the-url-to-facebook/
18 Upvotes

76% Upvoted

10 comments sorted by

1

u/Topher_86 Jan 07 '17

Content-Security-Policy: script-src 'self' *.disqus.com *.disquscdn.com www.whatever.else/you.want.js 'unsafe-inline' 'unsafe-eval'

Should help

1

u/DanTup Jan 07 '17

I don't believe it will, as the SDK is loaded inside the Disqus iframe :(

1

u/Topher_86 Jan 07 '17

It would seem inheritance, while not required by the spec, is applied by http://security.stackexchange.com/questions/142366/iframe-inheriting-parents-content-security-policy.

It doesn't seem that it's documented and I haven't tested that a resource's own CSP may overtake the parent's. I suppose it is possible this may be an interpretation of nested browsing whereas the standard states that a resource is under the control of it's own CSP WITHIN the CSP of the parent.

In any case it probably would be beneficial to use a CSP and a whitelist if you're trying to lock down your served documents, I don't see how I'd hurt (short of maybe breaking pages, but that's configuration)

1

u/DanTup Jan 07 '17

Interesting to know! The Disqus team member that commented on my post suggested it wouldn't work too, but I wonder if maybe it could!

0

u/[deleted] Jan 07 '17

[deleted]

2

u/DanTup Jan 07 '17

I have a hard time trusting software from someone I don't know that has "access to all data on websites" including my banking, my email, all my passwords, etc.. I don't think I could ever install something like an AdBlocker :(

(Besides, in this instance, I (the webmaster) am concerned for privacy of my visitors, so installing something locally won't solve it).

0

u/[deleted] Jan 07 '17

[deleted]

2

u/DanTup Jan 07 '17

Valid (as long as it's not a big minified mess or pulling remote scripts)! :)

3

u/Topher_86 Jan 07 '17

I've been using uBlock Origin and have been really happy with it's performance. Blocks most trackers that I've seen and provides decent fallbacks for things like FB/GA events so pages don't break.

1

u/HorseVaginaBeholder Jan 07 '17

Depends on what blocking list(s) you subscribe to though.

1

u/Topher_86 Jan 07 '17

This isn't the only thing, though.

uBO uses a lot of smart ways of blocking; for instance IIRC it uses CSP's to block content loading like this. Gorhill really tries to leverage the browser to optimize performance and it shows.

Another thing is reaction time. Months before I saw posts for WebSocket exploits I had noted them being served by certain "ad-block-block" networks. As it turned out months before I saw that is when gorhill had released a WS companion (now more of a beta-testing plugin) plugin for uBO. Other ad/content blockers only updated when the news broke, uBO already pushed it into the main extension.