3 ms·
What would such a cross-site scripting vuln do? There isn't anything to steal. Moreover you wouldn't use this for anything where you aren't in control of where
by chias 8y ago
What would such a cross-site scripting vuln do? There isn't anything to steal.
Moreover you wouldn't use this for anything where you aren't in control of where people get the links from, because as soon as someone else starts sharing it they can of course edit it too.
- gbba 8y agoThe trustworthiness of the domain name would effectively be stolen.
- chias 8y agoI disagree. It's more similar to how you can "inject" your scripts into fiddle.jshell.net (via JSFiddle), googleusercontent.com (via Google Translate), etc. Have a look at https://fiddle.jshell.net/pvcL4mjh/1/show/light/ https://fiddle.jshell.net/pvcL4mjh/1/show/light/ Would you call that XSS / did I just steal JSFiddle's trustworthiness?
- ummonk 8y agoThat's a fair point.