4 ms·
Sure there is (I agree js doesn't know the difference, but we do, and we are the music makers). trusted: I wrote it / looked over the source code untrusted: I
by axod 17y ago
Sure there is (I agree js doesn't know the difference, but we do, and we are the music makers).
trusted: I wrote it / looked over the source code
untrusted: I pasted some <script src=http://gonnaHackU.com/blah.js> http://gonnaHackU.com/blah.js> into my page.
Including <script> tags from external entities is always a potential security risk. And it's always better to do it serverside if at all possible.
- gdp 17y agoRight, but that's just a social distinction. It does nothing to protect users from careless web developers, and it does nothing to help web developers be less careless. Please, somebody think of the users! There are obvious technical solutions to this, but people seem unwilling to acknowledge that they might even be necessary.