2 ms·
The linked article demonstrates even just allowing attacker-controlled function name can allow an XSS hole!
by eli 12y ago
The linked article demonstrates even just allowing attacker-controlled function name can allow an XSS hole!
- simonw 12y agoThat's due to an extremely complex (albeit easy to exploit) SWF reflection attack. JSONP itself, though yucky, should still be safe from XSS given a /-star-star-/ prefix and a validated callback parameter.
- spacemanmatt 12y ago> given a /-star-star-/ prefix and a validated callback parameter. I think that is the "waiting to happen" part of my initial comment.