Is anybody actually using xmlhttprequest in a WebView?
xmlhttprequest was the subject of a CAN advisory in May, but it is
available to Dashboard scripts and also works for me in Safari,
contrary to the docs (http://developer.apple.com/internet/
webcontent/xmlhttpreq.html) stating that it won't go across domains
no less.
If you can do a cross-domain XMLHttpRequest in Safari, then this is a
serious security issue. Do you have code that demonstrates the
exploit? (Note: from a local file HTML document accessed via a file:
URL you can make an XMLHttpRequest to anywhere on the net.)
Regards
Maciej
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webkitsdk-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/webkitsdk-dev/email@hidden
