Host webpages on Google Drive

Re:Host webpages on Google Drive by rgbrenner on Tuesday February 05, 2013 @02:13PM (#5172566)

What security issue are you thinking of? JavaScript doesn't run anything server-side...

[ Parent | on HN ]

Re:Host webpages on Google Drive by lmkg on Tuesday February 05, 2013 @02:29PM (#5172682)

Being able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the malicious JS would be from the same origin, it's no longer cross-site, and gets a free pass around some of the browser's anti-XSS features.

[ Parent | on HN ]

Re:Host webpages on Google Drive by rgbrenner on Tuesday February 05, 2013 @03:09PM (#5172935)

thanks... good info.. I knew I was forgetting something..

[ Parent | on HN ]

Re:Host webpages on Google Drive by mixedbit on Tuesday February 05, 2013 @02:31PM (#5172693)

JavaScript can access any page and cookie from the same domain. So if I visited your googledrive.com hosted site, JavaScript from your site could potentially retrieve and send to you any other content on googledrive.com to which I have access.

[ Parent | on HN ]

Re:Host webpages on Google Drive by rgbrenner on Tuesday February 05, 2013 @02:59PM (#5172885)

thanks.. I was sure I was forgetting something...

[ Parent | on HN ]