Comments on: CSSHttpRequest: cross-domain Ajax using CSS for transport.

By: borisreitman

borisreitman — Sun, 03 May 2009 13:59:24 +0000

Checkout http://code.google.com/p/crossxhr/ for an alternate implementation based on flash.

By: Aimos

Aimos — Sat, 25 Oct 2008 12:44:04 +0000

I could write CSS as JSON like here http://www.featureblend.com/css-json.html and ajax it with jquery onReady and attach like so all css at the end. CSS these days gets very huge. The only problem would be the caching of the actual css file. If it would be possible to do that and at the end attach via jquery an external css file to the dom and the browser caches that file. It could be fast. May be … no idea :D

By: Jordan

Jordan — Sat, 25 Oct 2008 05:05:38 +0000

“…untrusted third-party JavaScript cannot execute in the context of the calling page.”

What about loading a CSS file with:

body {width:expression(“alert(‘code’);”)}

By: PeterMichaux

PeterMichaux — Fri, 24 Oct 2008 21:56:19 +0000

VK on comp.lang.javascript did similar hacky things

http://jsnet.sourceforge.net/

I wouldn’t use this technique. Too hacky.

By: Hans Schmucker

Hans Schmucker — Fri, 24 Oct 2008 20:31:51 +0000

Whenever a non local image is drawn onto a canvas it becomes “tainted” and won’t allow for pixel level manipulation anymore. They thought of that :)

By: Spocke

Spocke — Fri, 24 Oct 2008 18:21:51 +0000

Hacks like this isn’t that future proof. But they are still interesting. :) But I think the window.name approach is cleaner even though it is also a hack.

By: blinkingmarquee

blinkingmarquee — Fri, 24 Oct 2008 16:52:01 +0000

of the CANVAS tag the above should have said

By: blinkingmarquee

blinkingmarquee — Fri, 24 Oct 2008 16:51:28 +0000

Does not work in Opera 9.6 unfortunately.

Could an exploit of the tag’s getPixel() allow similar data passing cross domain from picture files? Seems like this has already been thought of in Opera 9.x

By: ThomasHansen

ThomasHansen — Fri, 24 Oct 2008 16:28:08 +0000

Funny, unfortunately probably not anything more than funny though … ;)
My guess is that this will only work until most browser vendors figures it’s actually a security hole or something…