Re: What is the same-origin policy for (was Re: The Origin header)

Ian, are you aware that that will provide CSS the power to execute
javascript cross-site? (think on XSS).

Right now we can't do this on firefox anymore, because they limited it to
same domain, but if this gets implemented then attacker.com will just send
the header so his script will be loaded.

I thought that was the reason moz bindings were disabled in the first place
=/ because noone wanted CSS to execute JS.

Greetings!!

-- Eduardo
http://www.sirdarckcat.net/

Sent from Hangzhou, 33, China

On Mon, Dec 7, 2009 at 3:28 PM, Ian Hickson <ian@hixie.ch> wrote:

> On Mon, 7 Dec 2009, sird@rckc.at wrote:
> >
> > a.example.com/mozbind.html
> >
> > or
> >
> > b.example.net/binding.xml
>
> Both. a.example.com/mozbind.html has to reference
> b.example.net/binding.xml, and b.example.net/binding.xml has to opt-in to
> supporting a.example.com.
>
> --
> Ian Hickson               U+1047E                )\._.,--....,'``.    fL
> http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
> Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'
>