[whatwg] DnD Jacking

Biju Gm@il bijumaillist at gmail.com
Sun Jan 25 20:00:51 PST 2009

At http://bijumaillist.googlepages.com/2in1.html
i have iframed http://bijumaillist.googlepages.com/dnd.html
and http://www.whatwg.org/demos/2008-sept/dnd/dnd.html

Now I can drag items between iframes.
This is good when we do mashups.

But I wonder whether this will create a similar vulnerability like
Click Jacking.
- ie, A cross site DnD Jacking

So how can I...
1. say to where all (domain) things can be dragged?
2. find from which domain things are dropped.
3. find the handle of source window at destination and vice versa.
4. while we in ondragenter/ondragover phase find what will be dropped later.


More information about the whatwg mailing list