3 ms·
I think there are security issues, as it "works" by copying the HTML of the page and overlaying a canvas on top. So, for e.g., if you post a HN page, I could c
by xtacy 16y ago
I think there are security issues, as it "works" by copying the HTML of the page and overlaying a canvas on top. So, for e.g., if you post a HN page, I could copy the URL for upvoting, trick you into clicking it and get an upvote automatically. The auth token in the upvote URL is supposed to prevent CSRF attacks, so it's dangerous to give it away!
It's also a problem with websites that store temporary auth tokens on the webpage, though I don't know any.
- photon_off 16y agoAs with all bookmarklets that include dynamic scripts, there's the security issue of XSS as well, including cookie hijacking and form posting. It completely a matter of trust that the bookmarklet you're running is safe, and hasn't been modified to do anything bad.
- xtacy 16y agoI completely agree with you. But then, I have to trust only the bookmarklet provider not to do malicious stuff; here, even if I trust markup.io, I still have to trust others who are going to view my markup.