How Google Wave cannot be XSS injected by a widget
- by Axel
Hello,
If you've used google wave you probabely seen that you can insert widgets that are made by third parties without approval. the Question is : How this widgets can't inject XSS or steal the cookies, Are the widgets loaded in an <iframe> ? if yes, then how they can't redirect google wave to another page?
Thanks