- From: Collin Jackson <w3c@collinjackson.com>
- Date: Sat, 5 Dec 2009 12:43:24 -0800
- To: Boris Zbarsky <bzbarsky@mit.edu>
- Cc: Adam Barth <w3c@adambarth.com>, sird@rckc.at, public-web-security@w3.org
On Sat, Dec 5, 2009 at 11:05 AM, Boris Zbarsky <bzbarsky@mit.edu> wrote:
> On 12/5/09 1:05 PM, Collin Jackson wrote:
>> It seems like CSS3 is adding a lot of attack surface
>
> Maybe I'm missing something... what attack surface is being added here,
> exactly? Attribute selectors?
Right. Attribute selectors that can read the values of input fields
and send the result over the network.
Injection of malicious style rules ("cross-site styling" if you like)
without attribute selectors is still dangerous, but may require more
social engineering to get private data, especially if the attacker
can't inject arbitrary HTML elements.
To be clear -- I'm not advocating to kill browser support for
attribute selectors, just arguing that the existence of attribute
selectors isn't a reason to kill seamless.
Collin
Received on Saturday, 5 December 2009 20:44:23 UTC