Re:PageFair: Economist hacked
by e12e on Friday November 06, 2015 @05:25AM
(#10518708)
Thanks for the link. I agree, it's a very nice disclosure.
I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript.
One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?)
(The other being an ad network, disqus, google analytics (now that is ironic) and "add this")
I do find it somewhat ironic that that page links in javascript from 5(?) other domains according to noscript.
One of which is good old s3.amazonaws.com - which if this allows CORS in general is basically allowing any random person to inject js in your page? (I believe any bucket in the standard US east region is reachable as s3.amazonaws.com/example.com/example.js ?)
(The other being an ad network, disqus, google analytics (now that is ironic) and "add this")