Reading System Security

[rkwright]

Aside from the issues of security related to the use of the an internal HTTP server in Readium (both 1, and now probably in 2), there are some more general issues related to the use of scripting with a browser engine. The attack vectors include:

• iframe sandboxing
• resource domains/origins
• window.top/parent
• window.frameElement.ownerDocument.defaultView

@ryanackley wrote a document on these subjects some time ago. The doc is here

[danielweck]

Just to be clear: Ryan wrote another document than the one linked (but I can't find it :)

[rkwright]

A couple of other potentially relevant sources of info from the widget work in EPUB 3.x:

• Security and Privacy
• Widget Security Use Cases