- From: Marcos Caceres <marcosscaceres@gmail.com>
- Date: Wed, 10 Dec 2008 10:55:48 +0000
- To: "Adam Barth" <w3c@adambarth.com>
- Cc: "Jonas Sicking" <jonas@sicking.cc>, "Simon Pieters" <simonp@opera.com>, "Laurens Holst" <lholst@students.cs.uu.nl>, public-webapps <public-webapps@w3.org>
On Tue, Dec 9, 2008 at 10:06 PM, Adam Barth <w3c@adambarth.com> wrote: > On Tue, Dec 9, 2008 at 12:42 PM, Marcos Caceres > <marcosscaceres@gmail.com> wrote: >> If authors want to use "application/xml", >> then they can use <content src="somefile" type="application/xml" /> >> and hope for the best :) > > I haven't been following the widget discussion very closely, so I > apologize if this issue is understood already, but, in general, being > able to coerce an arbitrary URL to application/xml is a big security > problem. Can you point me to where the <content> tag is defined? The content element is defined here: http://dev.w3.org/2006/waf/widgets/#the-content Would certainly appreciate more details about the security threat. Kind regards, Marcos -- Marcos Caceres http://datadriven.com.au
Received on Wednesday, 10 December 2008 10:56:30 UTC