2023-07-01 11:44 UTC
Just think, now every single site that has an #embedded #tweet view in an article is no longer displaying that tweet.
* At best, #Elon can show whatever he wants on it's place, tweet-by-tweet from subtle change to full-on counter-factual or malvertising.
* At worst, it's a vector for Elon #musk to run whatever *code* he wants on your site.
Used an <iframe>? You're in the best case camp.
Used a #Twitter-hosted embed <script> ? Good luck.
Replies (1)
-
@devnull@crag.social 2023-07-01 18:01
@toychicken sounds like a wonderful use-case to demonstrate exactly why a Content Security Policy is important! https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy