Dashboard possible Security issue
![]()
Hello,
in RTC dashboard is not possible to add Javascript for security reasons, however, it is possible to emmbedd iFrames with all sort of Javascript, Java and Flash inside. You can try by adding an HTML ViewLet with the following code:
to have a working google page. but you can also add pages containing full Java applications:
and even Full Screen Flash presentations (it's a joke, press ESC to close)
Doesn't this poses a security concern? Why disabling JavaScript but leaving iFrame? Thanks Umberto |
8 answers
![]()
Hi Umberto,
From what I've seen and read, browsers are quite good when it comes to iframe security. With the same-origin policy in place, the browser will not let the script in the iframe reach out and do anything to the outer window unless it's from the same host. If you can find any specific vulnerabilities, please e-mail me directly at curtispd@ca.ibm.com (rather than exposing a vulnerability here). Thanks, Curtis |
![]()
Hi,
does anybody know about changes on this respect? Umberto, in RTC 3.0.1 it seems your examples doesn't work anymore for html viewlet. Thanks! Regards, Jorge. |
![]() Hi, Hi Jorge, to my experience it seems that iframe and scripts has been removed from the Dashboard in version 2.0.x, but I was unable to find any work item related to this change. My dashboard was relying on iframes to display a lot of information from other locations. Regards, |
![]()
In 3.0.1 there is a new viewlet, External Content, which you can use to embed outside pages on your dashboards (it uses an iframe internally to show the content). It can be configured with the URL, height, and refresh interval.
|
![]()
Hello Curtis,
that will embed the actual content into the viewlet but, if any jscript is needed, then we would have to create our own custom viewlet, right? Thanks in advance for your help. Regards, Jorge. |
![]()
You can run any javascript in your HTML page inside the iframe, but not outside the iframe on the dashboard page. So if you need to construct or manage an iframe in a custom way, you would need to write a custom viewlet/gadget.
|
![]()
If iframe can be used in the new External Content viewlet, why not enable it in Headlines and HTML and make life a little easier for us users out here. I would like to use Headlines but I need a way to externalize the data (html) and iframes would be the perfect solution, except I can't use it. I would like to avoid writing a custom viewlet just for this, but it looks like there is no alternative. Say it ain't so Joe.
|
Your answer
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.