I wanted to announce a Pomcor white paper that
looks at attacks through HTML shared files in Web
applications and proposes a countermeasure. These
are essentially XSS attacks, but the usual
defenses against XSS are typically not available,
because shared files cannot be sanitized.
The paper is available at:
I have not been able to find much prior work.
What I've found is discussed in Section 2 of the
paper. If I've missed something, please let me