Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
examples:example4 [2009/10/20 12:50] aspectscript |
examples:example4 [2009/10/26 16:22] aspectscript |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== Access Control with Scoping Strategies ====== | ||
| + | |||
| Most modern Web applications allow third-party applications to provide extra | Most modern Web applications allow third-party applications to provide extra | ||
| functionality through an API. However, one of the most attractive features | functionality through an API. However, one of the most attractive features | ||
| Line 25: | Line 27: | ||
| < | < | ||
| - | | + | |
| + | < | ||
| + | <link href="/ | ||
| + | <script type=" | ||
| + | < | ||
| + | <iframe id=" | ||
| + | <a id=" | ||
| </ | </ | ||
| - | However, if the malicious application changes to: | + | \\ However, if the malicious application changes to: |
| <code java> | <code java> | ||
| var maliciousApplication = { | var maliciousApplication = { | ||
| - | | + | |
| action : function() { | action : function() { | ||
| | | ||
| + | } }; | ||
| + | </ | ||
| + | |||
| + | Or to: | ||
| + | |||
| + | <code java> | ||
| + | var maliciousApplication = { | ||
| + | fakeURL : ' | ||
| + | action : function() { | ||
| // modification scheduling in 100 ms | // modification scheduling in 100 ms | ||
| var fakeURL = this.fakeURL; | var fakeURL = this.fakeURL; | ||
| Line 40: | Line 58: | ||
| </ | </ | ||
| - | It is not possible to identify the malicious action of the application. A solution to this problem is to use a more expressive scoping | + | It is not possible to identify the malicious action of the application |
| The implementation follows: | The implementation follows: | ||
| + | |||
| < | < | ||
| - | | + | <link href="/ |
| + | <script type=" | ||
| + | < | ||
| + | <iframe id=" | ||
| + | <a id=" | ||
| </ | </ | ||