3 ms·
What security issue are you thinking of? JavaScript doesn't run anything server-side...
by rgbrenner 14y ago
What security issue are you thinking of? JavaScript doesn't run anything server-side...
- lmkg 14y agoBeing able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the malicious JS would be from the same origin, it's no longer cross-site, and gets a free pass around some of the browser's anti-XSS features.
- rgbrenner 14y agothanks... good info.. I knew I was forgetting something..
- mixedbit 14y agoJavaScript can access any page and cookie from the same domain. So if I visited your googledrive.com hosted site, JavaScript from your site could potentially retrieve and send to you any other content on googledrive.com to which I have access.
- rgbrenner 14y agothanks.. I was sure I was forgetting something...