I just hope they used a proper lib like Purifier to do it, or someone's going to... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		ceejayoz on April 14, 2014 \| parent \| context \| favorite \| on: NEVER sanitize your inputs I just hope they used a proper lib like Purifier to do it, or someone's going to have fun with `onmouseover`.

nraynaud on April 14, 2014 [–]

I think that when it's sandboxed with the proper attributes, you can't do anything appart from trashing the content of the frame.

ceejayoz on April 14, 2014 | [–]

I had no clue that was so widely supported. No IE8/9 but virtually everything else. Neato! http://caniuse.com/#feat=iframe-sandbox

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact