search

letsgetrandy / DICSS

Directly injected CSS
http://letsgetrandy.github.io/DICSS/
MIT License
1.35k stars 72 forks source link

unsafe for use in front and back ends during same session #31

Open redengin opened 9 years ago

redengin commented 9 years ago

The users are reporting serious infections.

fetalerror commented 9 years ago

I haven't seen this use case except in production. Its usually the user-agent trying to enhance the content. In real user mode I don't think you'll see this issue.

redengin commented 9 years ago

Thanks for the advice in exploring the user-agent. I think I've found a workaround for most user-agents. I've added a sanitize method after the pullOut from the back-end. The user-agent is happy, since the end result is one continuous set of content, as the sanitize step is nearly undetectable.

Currently my sanitize step is hardcoded for production, but if there were some way to detect that DICSS had been used in the back-end it'd be simple to add a conditional to the body.ready() prior to putIn. This would make this use-case safer for non-production environments.

ghost commented 9 years ago

This shouldn't be a problem if you use separate wrappers for your front-end and back-end.