|
|
@@ -623,7 +623,7 @@ archivebox config --set CHROME_BINARY=chromium # ensure it's using Chromium
|
|
|
|
|
|
### Security Risks of Viewing Archived JS
|
|
|
|
|
|
-Be aware that malicious archived JS can access the contents of other pages in your archive when viewed. Because the Web UI serves all viewed snapshots from a single domain, they share a request context and **typical CSRF/CORS/XSS/CSP protections do not work to prevent cross-site request attacks**. See the [Security Overview](https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overview#stealth-mode) page for more details.
|
|
|
+Be aware that malicious archived JS can access the contents of other pages in your archive when viewed. Because the Web UI serves all viewed snapshots from a single domain, they share a request context and **typical CSRF/CORS/XSS/CSP protections do not work to prevent cross-site request attacks**. See the [Security Overview](https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overview#stealth-mode) page and [Issue #239](https://github.com/ArchiveBox/ArchiveBox/issues/239) for more details.
|
|
|
|
|
|
```bash
|
|
|
# visiting an archived page with malicious JS:
|
|
|
@@ -635,6 +635,8 @@ https://127.0.0.1:8000/archive/*
|
|
|
# then example.com/index.js can send it off to some evil server
|
|
|
```
|
|
|
|
|
|
+The admin UI is also served from the same origin as replayed JS, so malicious pages could also potentially use your ArchiveBox login cookies to perform admin actions (e.g. adding/removing links, running extractors, etc.). We are planning to fix this security shortcoming in a future version by using separate ports/origins to serve the Admin UI and archived content (see [Issue #239](https://github.com/ArchiveBox/ArchiveBox/issues/239)).
|
|
|
+
|
|
|
### Saving Multiple Snapshots of a Single URL
|
|
|
|
|
|
First-class support for saving multiple snapshots of each site over time will be [added eventually](https://github.com/ArchiveBox/ArchiveBox/issues/179) (along with the ability to view diffs of the changes between runs). For now **ArchiveBox is designed to only archive each unique URL with each extractor type once**. The workaround to take multiple snapshots of the same URL is to make them slightly different by adding a hash:
|
Nick Sweeting