Allow zite loading outside iframe (for zite owners)

[antilibrary]

Would it be possible to add a flag that would allow a zite to be loaded directly instead of loading it inside an iframe?
The problem is that for tools like vuejs-devtools to work the vue.js script must be present in the page itself. If the script is inside the iframe the tool won't detect the script.
I could use that tool by loading the file directly on file:// but then the zeronet api will not work.
Maybe the flag can be set only if the person is the site owner.

Thanks

[HelloZeroNet]

I got the barrier when tried to get grapejs work. I will check what's the best way to remove the limitations of sandboxed iframe.

[Snarkly]

Thanks for trying to get grapejs to work on Zeronet. I hope to someday be able to create a nice site on Zeronet without needing to code anything.

[HelloZeroNet]

Possible security problems of removing sandboxing (by default):

Accessing global variables of the frame: wrapper_key, websocket connection

Solution: delete from global context before injecting the iframe

localStorage / cookie access

Solution: delete localStorage then replace it with a object that only allow access to site's storage

Change url by replace/push state

Solution: Replace it with an object that only allow to change to url within the site's address

No hidden DOM: Read entered private key from sidebar/notification

Solution: Put the sidebar to sandboxed iframe?

Other possible security issues?

...

[purplesyringa]

delete localStorage will only delete window.localStorage. It is possible that localStorage object can be accessed another way, so delete localStorage won't help.

[HelloZeroNet]

@imachug I have not found other way to access localStorage, so proof-of-concept:

class RestrictedLocalStorage {
	constructor (ls) {
		Object.assign(this, {
			setItem(key, val) {
				console.log("set " + key + " = " + val)
				return ls.setItem(key, val)
			}
		})

		Object.assign(this, {
			getItem(key) {
				console.log("get " + key)
				return ls.getItem(key)
			}
		})
	}
}

restricted_localstorage_handler = {
	get (target, key) {
		console.log("proxy get", key)
		if (key == "getItem" || key == "setItem") {
			return target[key]
		}
		return target.getItem(key)
	},
	set (target, key, val) {
		console.log("proxy set", key, val)
		return target.setItem(key, val)
	}
}

localStorage.setItem("test", "hello")
console.log("test:", localStorage.getItem("test"))

rs_ls = new RestrictedLocalStorage(window.localStorage)
rs_ls_proxy = new Proxy(rs_ls, restricted_localstorage_handler)
delete window.localStorage
window.localStorage = rs_ls_proxy

console.log("ls object:", localStorage.ls)

console.log("test:", localStorage.getItem("test"))

localStorage.setItem("test2", "hello2")
console.log("test2:", localStorage.getItem("test2"))

localStorage["test3"] = "hello3"
console.log("array-like test3:", localStorage["test3"])

via Managing the private data of ES6 classes

[purplesyringa]

Do you know if localStorage.set/getItem is read-only? If it isn't, it would be more secure to use localStorage.set/getItem = ... instead.

[HelloZeroNet]

Yes it's possible (I have only tested all of this in Chrome yet), but it's also possible to use localStorage["anything"] = "other" which I have not found a way to override

I have updated the poc code with array-like object access support using a Proxy (not sure if it's possible without it)

[purplesyringa]

Looks interesting. Though I think some other ops like clear should be allowed, but otherwise it's ready.

[HelloZeroNet]

Unfortunately I found a way to recover the original localstorage object by creating an sub-iframe. So probably we can't protect cross-site localstorage access.

[HelloZeroNet]

I have added a new NOSANDBOX permission in Rev3335 that should remove the sandboxed iframe restrictions.

As for example I created a demo for grapejs online html editor that is using iframes, so it did not works under sandboxed iframe restrictions:
http://127.0.0.1:43110/1Grapes1bMdkcoM8CtjboJtPS1kvbtqMUj/editor.html

[tangdou1]

How can I use this NOSANDBOX permission. There is no sign in the content.json. Thanks!

I believe your zite has to ask for the permission to be added, then the user must accept that permission.
I don't know the specific command to call to ask for the permission, but it's either in the ZeroFrame API Reference or will be.