That didn't take long! I wonder if the security holes are in the host or OpenSocial, itself.

Quoted: It didn't take long for someone to hack the first OpenSocial application. In fact, it took just 45 minutes. A developer who goes ...

Apple's early paper on using IFRAME's to accomplish remote scripting. Could still be useful in some cross-site scripting scenarios.

Proposal to implement a JSONRequest object in every browser. Proposed method supports anonymous sending and reveiving of JSON (no cookies transmitted), and therefor exempts from the same-origin policy of XMLHttpRequest.

Nice little post (and example) of Session Riding vulnerability.

Setting "fragment identifiers" (anchor names) in URL's of IFRAME and it's parent page for use as a cross-site scripting protocol. What a KLUDGE!

Good reference to a paper on cross-site scripting vulnerabilites is AJAX code.

http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf

The attack using a hook to capture any event that sets a know property:

function Object()
{
this.email setter = captureObject;
}

Note the flame-war between antibozo and kentaromiura in the comments. It actually resolves itself quite amicably in the end.

Quoted: An application can be mashup-friendly or it can be secure, but it cannot be both.
...
Solutions:
o Include a hard-to-guess identifier, such as the session identifier, as part of each request
that will return JavaScript. This defeats cross-site request forgery attacks by allowing the
server to validate the origin of the request.
o Include characters in the response that prevent it from being successfully handed off to a
JavaScript interpreter without modification. This prevents an attacker from using a
<script> tag to witness the execution of the JavaScript.

Vulnerable frameworks include: Prototype, Script.aculo.us, Dojo, Moo.fx, jQuery, Yahoo! UI, and MochiKit.

JSON security flaw in GMail (now fixed).

This was a document for a Dec 20th vulnerability - presumably different from the one publicized on Jan 20?