Replying to @mmatthiesen and @publictorsten
So you would ban all JS in creatives unless they are accepted for a given vendor/purpose reason? If not then top.location = "http://evil" remains just as easy.
Tweet · 21 Jul 2018, 17:21 UTC