Quote:
Originally Posted by JSWolf
I've always thought that javascript inside and eBook was a rather bad idea. It's a book, not a computer program.
|
Yes, Javascript is clearly a significant attack vector. I guess the JS engine can be restricted to only have read access to the filesystem (or no access) and similarly no access to the network, and then you need to prevent resource exhaustion type attacks.
But even plain old XML can also be abused in interesting ways. XML External Entities (e.g. "billion laughs") and XIncludes....