Re: Seamless iframes + CSS3 selectors = bad idea

On Sat, Dec 5, 2009 at 11:05 AM, Boris Zbarsky <bzbarsky@mit.edu> wrote:
> On 12/5/09 1:05 PM, Collin Jackson wrote:
>> It seems like CSS3 is adding a lot of attack surface
>
> Maybe I'm missing something... what attack surface is being added here,
> exactly?  Attribute selectors?

Right. Attribute selectors that can read the values of input fields
and send the result over the network.

Injection of malicious style rules ("cross-site styling" if you like)
without attribute selectors is still dangerous, but may require more
social engineering to get private data, especially if the attacker
can't inject arbitrary HTML elements.

To be clear -- I'm not advocating to kill browser support for
attribute selectors, just arguing that the existence of attribute
selectors isn't a reason to kill seamless.

Collin

Received on Saturday, 5 December 2009 20:44:23 UTC