3 ms·
>Stealing web page content by tricking the browser to load the private page as CSS This exploit is not practical in Firefox. Attempting to read cssRules on an
by lol768 8y ago
>Stealing web page content by tricking the browser to load the private page as CSS
This exploit is not practical in Firefox. Attempting to read cssRules on an external stylesheet will throw a "SecurityError: The operation is insecure".
Chrome mitigates this via Cross-Origin Read Blocking.
> Phishing with target=_blank links
For defense in depth, you'll probably want to use CSP's disown-opener to fix this globally (rather than trying to make sure all <a> elements are covered) IMO.
- ggeorgovassilis 8y agoI'm glad to learn that browsers tighten security as a response to such exploits. My, personal, takeaway is that user input needs to be validated at every level; if I cannot implement proper validations (e.g. analysis of user-contributed CSS), I'll have to prevent that input altogether.
- chris_st 8y ago> user input needs to be validated at every level Possibly the best advice a new web developer can get. Once you realize what kinds of things can happen with unvalidated user input, it really changes your outlook!
- jusob 8y ago> use CSP's disown-opener to fix this globally Except no browser supports it yet (see table at https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)