HTML imports: new XSS hole? from Anne van Kesteren on 2014-06-02 (public-webapps@w3.org from April to June 2014)

From: Anne van Kesteren <annevk@annevk.nl>
Date: Mon, 2 Jun 2014 11:32:45 +0200
To: WebApps WG <public-webapps@w3.org>
Cc: Jonas Sicking <jonas@sicking.cc>
Message-ID: <CADnb78h7TMmjdGupu3COOv6ccxm6AK-1=Y-w-pYOUnVChXX0XA@mail.gmail.com>

How big of a problem is it that we're making <link> as dangerous as
<script>? HTML imports can point to any origin which then will be able
to execute scripts with the authority of same-origin.


-- 
http://annevankesteren.nl/

Received on Monday, 2 June 2014 09:33:12 UTC