> On Wed, 20 Jul 2011 05:07:05 +0200, Boris Zbarsky <bzbarsky at mit.edu> > wrote: >> That said, I'm not sure I understand the security concern. What kind >> of whitelist-based filter would let through <script>s whose URIs it >> does not control, exactly? Can the security concern be mitigated by >> only allowing <base> outside <head> if the base URI it sets is >> same-origin with the document? > > The <script> is from the page itself and uses a relative URL. The > <base> is inserted by the attacker and causes the script to be > requested from a server under the attacker's control. > > Seems like a bug in the whitelist filter to me. Shouldn't the filter be checking requests using the full URL just before they are dispatched? Regards -MarkReceived on Thursday, 21 July 2011 20:51:46 GMT
This archive was generated by hypermail 2.2.0+W3C-0.50 : Wednesday, 30 January 2013 18:48:04 GMT