But yeah, the article isn’t very clear on what it means.
dos I could see via just provoking a ton of same domain requests in the svg, like loading a lot of images from the same domain. Then every user seeing it would take part in dosing that page.
XSS could mean data exfiltration, which should still pass most restrictions currently.
Would data exfiltration work, though? I forget exactly what the header value is, and am far too lazy to look it up right now, but I’m pretty sure there’s a standard one that lets a website define where requests should be allowed to point at. Unless they’re scraping the data themselves, but then that hardly needs malicious JS.
xss not css. css are the style sheets :)
But yeah, the article isn’t very clear on what it means.
dos I could see via just provoking a ton of same domain requests in the svg, like loading a lot of images from the same domain. Then every user seeing it would take part in dosing that page.
XSS could mean data exfiltration, which should still pass most restrictions currently.
Would data exfiltration work, though? I forget exactly what the header value is, and am far too lazy to look it up right now, but I’m pretty sure there’s a standard one that lets a website define where requests should be allowed to point at. Unless they’re scraping the data themselves, but then that hardly needs malicious JS.