3 ms·
Why is JSONP any less than an XSS exploit waiting to happen?
by spacemanmatt 12y ago
Why is JSONP any less than an XSS exploit waiting to happen?
- simonw 12y agoI don't think you can use JSONP for XSS. The JavaScript does to execute on the domain that hosts the JS, it executes in the context of the page that loaded the code using a script tag. Allowing attacker-controlled script tags is definitely an XSS hole.
- eli 12y agoThe linked article demonstrates even just allowing attacker-controlled function name can allow an XSS hole!
- simonw 12y agoThat's due to an extremely complex (albeit easy to exploit) SWF reflection attack. JSONP itself, though yucky, should still be safe from XSS given a /-star-star-/ prefix and a validated callback parameter.
- spacemanmatt 12y ago> given a /-star-star-/ prefix and a validated callback parameter. I think that is the "waiting to happen" part of my initial comment.
- wmil 12y agoIt seems to me that the real problem is that flash has access to browser cookies without following the browser security model.