3 ms·
If php.net used CSP, they would have been able to mitigate this attack with the frame-src directive [1]. [1] http://www.w3.org/TR/CSP/#frame-src http://www.w3.
by handsomeransoms 13y ago
If php.net used CSP, they would have been able to mitigate this attack with the frame-src directive [1].
[1] http://www.w3.org/TR/CSP/#frame-src http://www.w3.org/TR/CSP/#frame-src
- yeukhon 13y agoIf they are able to hack the physical box (I assume this is how they did the injection), then it is possible for them to modify the CSP rule too. If my assumption is correct, then CSP won't help unless we separate the source server and the proxy server from each other.