4 ms·
What is the attack vector?
by dothis 8y ago
What is the attack vector?
- 11235813213455 8y agoXSS, can't you read?
- rictic 8y agoThere are a number of HTML attributes and properties that can result in redirects, HTTP requests, and evaluation of arbitrary code. If the developer uses databinding with untrusted input into any of these attributes or properties, their site may be exploitable. A databinding engine can do some things to protect against this. One way of handling this is to treat strings as untrusted by default, and require explicit wrapping types for trusted content, e.g. https://google.github.io/closure-library/api/goog.html.SafeUrl.html https://google.github.io/closure-library/api/goog.html.SafeU...