像“http://sharethis.com/”这样的小部件如何使用 进行看似 XSS 的调用
像这样的工具如何能够以 ajax 方式调用回中心站点？ 基本上，他们会给你一个“标签，放在你的网站上，无论它在哪里。所以在这个小部件中，你可以要求向你发送当前页面的电子邮件。我认为这会产生一个ajax但是，他们如何在您的服务器上没有代理且浏览器不会阻止它作为 XSS 漏洞的情况下执行此操作
？我认为使用 Flickr API 会带来同样的挑战？
链接来自标题：http://sharethis.com/
How is it that tools like this one can make an ajax style call back to a central site? basically they give you a " tag to put on your site where ever it is. So in this widget you have the ability to ask for an email to be sent to you for the page you're currently on. I assume this makes an ajax style call back to share this who sends out the email. But how can they do this with out a proxy on your server and without the browser blocking it as an XSS exploit?
Any answers on this would be greatly appreciated thank you for your help. I assume working with the Flickr API would present the same challenges?
Link from the title : http://sharethis.com/
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
他们为您提供一个脚本以包含在您的网站中。 该脚本可以完全访问 DOM 和您的 cookie。 为了让它回调到他们的站点，他们使用了一种称为 JSONP 的技术。 您包含的脚本在查询字符串中添加了带有参数的另一个脚本。 然后，服务器返回 JSON（即 JavaScript），并提取数据。
如果您正在构建混搭，则必须相信这些小部件不会执行恶意操作，例如窃取您的 cookie。 IE 8 将会更好地支持安全 XSS。
They give you a script to include in your site. This script has full access to the DOM and your cookies. In order for it to call back to their site, they use a technique called JSONP. The script that you included, adds another script with parameters in the querystring. The server then returns JSON (which is just JavaScript), and the data is extracted.
If you are building mashups, you have to trust that these widgets aren't going to do something malicious like steal your cookies. There will be better support for safe XSS in IE 8.
您甚至不需要为此使用 JSON。
您可以使用脚本标记从任何域检索 javascript 代码，因此许多这些小部件只是创建一个脚本节点，并且响应的格式如下：
someFunction 已经是原始小部件源中的现有函数，并将数据转储到您的DOM。
You don't even need to use JSON for this.
You can retrieve javascript code from any domain using a script tag, so a lot of these widgets just create a script node, and the response is formatted like:
someFunction is already an existing function in the original widget source, and dumps the data into your DOM.
答案是，出于某种原因，浏览器只阻止向原始服务器以外的服务器发送 XmlHttpRequest。 您可以自由使用 SRC 指向任何地方的
The answer is that browsers, by some reason, only block XmlHttpRequests to servers other than the originating one. You are free to use <SCRIPT>-tags that has SRC pointing to wherever, and such script tags can of course be dynamically inserted into your DOM.