News for hackers. Stuff that matters.
Re:Spectre and the end of langsec by ptx on Thursday January 11, 2018 @11:23PM (#16130383)
No, loading a script (from anywhere) effectively invites it into the origin of your page, giving it access to everything connected to the origin of the page. That is, the origin of the script is not considered, only that of the page.

Think about loading jQuery from a CDN, for example, which people do. If third-party scripts couldn't access the DOM it wouldn't be very useful.

There are no comments on this comment yet.