2

In the documentation for phantomjs, there is an option to turn off web security and allow XHR (cross domain requests).

Does this present a security risk to a user if you are filling forms with credentials such as usernames and passwords and then downloading screenshots with casper/phantom?

rrrfusco
  • 1,099
  • 5
  • 19
  • 46

1 Answers1

3

Maybe.

Allowing cross domain XHR opens up a few attacks. E.g. see https://stackoverflow.com/a/7615287/841830. See also Is CORS a secure way to do cross-domain AJAX requests?

But this tends not to come up with the normal use cases for Phantom: whether you are testing your own web site, or screen-scraping, you tend to go to pre-decided URLs and links, and are not sending secret information, and are not going to be tricked by a new and suspicious link. You are unlikely to be logged into your bank, or Facebook, while testing your site or scraping google search results. (BUT, if you are scraping google pages that force you to sign into Google first, be a bit more careful - perhaps set up a dedicated gmail account just for your scraping.)

So, in summary, the attacks are a bit more obscure and unlikely, compared to a normal desktop browsing session, but they are still there, so only use --web-security=no when your script otherwise will not work.

Community
  • 1
  • 1
Darren Cook
  • 27,837
  • 13
  • 117
  • 217
  • 1
    Two things: 1. "switching off web-security skips the SSL certificate checks" I don't think this is true. `--web-security` doesn't concern the connection, AFAIK. For that `--ignore-ssl-errors=true` should be set. 2. Does `--web-security=off` really work? I always thought it must be either `no` or `false`, but not `off`. – Artjom B. Jun 03 '15 at 11:55
  • @ArtjomB. Thanks for the corrections. I thought --web-security did more than just allow any origin, but after trawling the webkit source, the only reference I could was doing that: https://github.com/adobe/webkit/blob/044126629b2e175119722f58a0098220e0aa0b33/Source/WebCore/dom/Document.cpp#L4557 – Darren Cook Jun 03 '15 at 16:14