Skip to main content
jeffreywh
jeffreywh
Participating Frequently
April 17, 2015
Question

Has anyone else run into security issues with whstub.js, whproxy.js, whtopic.js, ehlpdhtm.js, and whfhost.js?

  • April 17, 2015
  • 1 reply
  • 1801 views

We have a customer's security team objecting to the files because of an issue with their "Overly Permissive Message Posting Policy." An example:


Has anyone else run into this, and is there anything we can do to reduce the threat assessment?

This topic has been closed for replies.

1 reply

Captiv8r
Captiv8r
Legend
April 18, 2015

Perhaps try using Responsive HTML as an output type?

Willam van Weelden
Willam van Weelden
Inspiring
April 20, 2015

Even then there's still a lot of messages going forward and the ehlpdhtm.js is shared across outputs.

But the postMessage option used is safe since you need to write code specifically for getting these messages. No hijacking can just be done through this. (See also Window.postMessage() - Web API Interfaces | MDN)

The concern here is the domain policy in the call where the * is too permissive. But since the help can be placed on any given URL, there is no way for Adobe to do it differently. Personally, I don't believe this is an issue as postMessage is meant for secure communication and it's not something you can just hijack.

jeffreywh
jeffreywhAuthor
Participating Frequently
April 20, 2015

I will pass that along. I'm not in direct contact with the customer's security people, so I don't know their level of concern beyond what was passed to me.

In any case, thanks!

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices