7 ms·
The original page's JS might depend on the DOM tree of the page. Thus a change that doesn't obviously cause any information to be emitted to third parties can c
by robryk 10y ago
The original page's JS might depend on the DOM tree of the page. Thus a change that doesn't obviously cause any information to be emitted to third parties can cause that JS to do that (e.g. if the JS uses attributed of DOM tree nodes as URLs of data sources or data sinks).
- deno 10y agoThat’s valid. I still feel it would eliminate at least most of the abuse, like injecting ads though. Unless there’s something very widely deployed (say jQuery etc.) that’s vulnerable.