Re: Proposal to remove the 'frame-action' directive from CSP 1.1

On Mon, Jun 11, 2012 at 10:59 AM, Adam Barth <w3c@adambarth.com> wrote:
>
>
> It's actually really easy to use form-action 'none' in modern browsers:
>
> <form id="foo">
>  ...
> </form>
>
> == Some external script ==
>
> var theForm = document.getElementById("foo");
> theForm.addEventListener("submit", function() {
>  var xhr = new XMLHttpRequest();
>  xhr.open("POST", theURLToSendTheFormTo);
>  xh.send(theForm);
> }, false);
>
> Also, many sites already use XMLHttpRequest for all their
> client-to-server communication, so they wouldn't need to be modified
> at all.
>

In this case the attacker can just inject <form id="foo"> and trick the
external script from attaching the event listener to the wrong  form tag.

-- 
-Eric