glynnbird/birdreader — pull request #27 by maghoff (2014-02-19 20:54:16+00:00)
Title: Put RSS articles into sandboxed iframes, to prevent XSS problems

XSS type problems I've seen:

1. CSS leaking from the article onto the reader app
2. Javascript messing up the reader app

An example of 2. is , where each article contains the following script tag:

````html

````

Calling `document.write` like this causes the entire page to go blank.

The `iframe` contains the `sandbox` attribute and disables javascript entirely inside the `iframe`.

----

The `iframe` tags as generated in this pull request automatically gets sized to fit the contents in the vertical direction.

When navigating inside the `iframe`, that navigation takes effect inside that `iframe`, and no additional vertical resize is effected. This is a little weird, and I'm not entirely sure what to do about it. I recommend navigating to the article with the button in the reader interface.