Re: XSS mitigation in browsers

> The <meta> tag raises the issue of what to do if the policy is found
> after something that should have been covered by the policy. Ignore
> the policy (too late!), ignore the violation (injected scripts win),
> maybe reparse the document from the beginning and hope there weren't
> earlier violations that matter? Not insurmountable, but definitely
> will add to the complexity of the spec.

Yes, that's a problem if you allow multiple <meta> tags to specify a
single valid policy. In Adam's proposal, the policy must appear in a
single tag, which allows you to simply ignore all subsequent <meta>s
that would broaden the policy (and it can't be narrowed down, ruling
out the risk of policy deployment errors that accidentally give too
much access because of this parsing precedence).

/mz

Received on Friday, 21 January 2011 22:48:06 UTC