Does this really matter...
...and does any Londoner of sound mind give a flying....duck....what any website says about the candidates !!
This is an equal opportunity sneer !!
Ethical hackers have discovered potentially serious vulnerabilities on the websites of the two principal candidates in today's London Mayoral election. Both Boris Johnson’s and Ken Livingstone's campaign websites suffer from ‘cross-scripting’ (XSS) vulnerabilities that make it possible for hackers to redirect users to their …
You don't even need an iframe you can directly insert an img tag or even a script tag.
Simon's joke here with an img tag is much b=more transparent
This really isn't a trivial matter though - I mean some useless web development cretin actually got paid to make these sites and didn't think to sanitise the incoming data from the URI.
The IT industry really does make me spit blood sometimes; if architectural engineering was like software engineering we'd never have been able to get anything taller than a bungalow standing.
Web developers seem to be worse than the rest.
Yes, I am a web developer (LAMP with the 'P' being predominantly PHP) and some of the code I've seen makes me just stare in disbelief at the screen - how the hell people can sleep at night after foisting that shit on someone is beyond me. Look at PHP written by ASP "developers" and you'll want to cry.
[anonymous because slagging off the IT industry here, of all places, seems unwise]
Spotted and blocked by NoScript. It's a clever little tool to be sure.
It matters because the trick allows you to do pretty much anything you like, under the guise of being a legitimate site. See comments about drive-by malware downloads, etc.
Also, having a silly posting 'shtick' wasn't cool when amanfrommars did it either, though at least your effort is parseable.
I'd agree if they actually applied the same logic elsewhere.