JSONP & http://localhost.:/

Question

After reading JSONP callback doesn't execute when running at localhost and googling a lot, I am still unclear if there is a potential XSS security threat.

Is this "hole" covered in popular browsers nowadays?

(notice the dot in the URI)

Answer 1

Yes it is a potential security flaw, just be smart with your coding to check for XSS... I'm not sure but I think Firefox4 blocks this hole...