On 2/3/12 10:53 PM, Ian Hickson wrote:
Surely for the style sheets there's far less of a difficulty in getting things right? I don't really understand what vulnerability would be relevant here such that you'd need per-stylesheet control over what was being imported.
Hmm. I sort of assume that if you can control the styles you can really mess with the page, and probably get the user to do things the user doesn't really want to do. But maybe this is me overworrying?
-Boris
