4 ms·
Is there anything that could fix this? Off the top of my head, browsers could encode the results of any functions that get the URL. But after encoding/decoding
by dexwiz 11y ago
Is there anything that could fix this? Off the top of my head, browsers could encode the results of any functions that get the URL. But after encoding/decoding requests/responses and unknown server logic, the encoding may be removed.
- chatmasta 11y agoAd blockers would fix it. Outside of that, ad companies hiring competent devs would fix it. But I suspect they're moving too fast and breaking too many things to worry about trivial matters like XSS scripting vulnerabilities. As a site owner, not embedding third party ads on your site would fix it. Then you only need to worry about your own code.
- mirimir 11y agoAdBlock and NoScript stops http://foo.bar/#1'-alert(1)-'"-alert(1)-" http://foo.bar/#1'-alert(1)-'"-alert(1)-" on every site that I've tested :)
- toast0 11y agoIf you do ad placements with iframes, that can mitigate some vectors, but then it is very hard to have full screen takeovers or many other hideous things that seem to make advertisers happy.
- pki 11y agohtml5-sandbox or iframe will have you terminated from adsense, at least. don't know about the others.
- aikah 11y ago> html5-sandbox or iframe will have you terminated from adsense, at least. don't know about the others. Really? what's the justification for that policy? You'd think ad networks would want ads to be safe for users.
- AkariTakai 11y agoProbably cross-domain abuse. I'd imagine there's a few edge cases that result in behavior Google doesn't want for ads. For example, double serving, accidental clicks, ad obscuring, etc. Their FAQ does mention that they'll grant exceptions though.
- annnnd 11y agoFor a site owner, using properly configured Content Security Policy somewhat mitigates the risk... depends on what you can close down though, some pages have just too many functionalities.