View source for Web-app-exploitation-entry-points

For [https://github.com/brettz9/asyouwish/ AsYouWish] (or older version at [https://addons.mozilla.org/en-US/firefox/addon/as-you-wish/ AMO] languishing in loneliness awaiting preliminary approval), while it opens up a lot of fun, it is also a bit scary given the number of ways in which its power could be exploited by the malicious.

Here are some entry points which require proper awareness if not sanitizing by AsYouWish websites (though they also may invite ideas for proper usage):

{| border=1 class=sortable
! Input source
! Protagonist
|-
| URL parameters || User in URL bar, user clicking third-party link, or user visiting third-party website (with hidden XSRF potential) || 
|-
| regular postMessage || Third-party developer
|-
| privileged postMessage (as from WebAppFind invocation from OS desktop and potentially in the future from [https://github.com/brettz9/atyourcommand AtYourCommand]) || User
|-
| registerProtocolHandler || User in URL bar, user clicking third-party link, or user visiting third-party website (with hidden XSRF potential)
|-
| bookmarklet || Third-party site (potentially coming from other users if XSS is an issue)
|-
| local data store || Potentially other users
|-
| remote data store || Potentially other users
|}

A very important principle is to make all GET-able URL-accessible parameters (URL parameters or custom protocols) idempotent, while allowing for pseudo-POST (via postMessage) to, if proper checks are in place, provide safe code with side effects (bearing in mind that a "null" origin may not differentiate between file:// URLs, etc.).

[[Category:Unfinished draft]]