Cross-Domain Content Inclusion
Framing and navigation are a distinct source of trouble, but these mechanisms aside, HTML supports a number of other ways to interact with non-same-origin data. The usual design pattern for these features is simple and seemingly safe: A constrained data format that will affect the appearance of the document is retrieved and parsed without being directly shown to the origin that referenced it. Examples of mechanisms that follow this rule include markup such as <script src=...>, <link rel=stylesheet href=...>, <img src=...>, and several related cases discussed throughout Part I of this book.
Regrettably, the devil is in the details. When these mechanisms were first proposed, nobody asked several extremely pressing questions: ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access