title: Security issue with dynamic script tags
body: <p>This <a href="http://code.flickr.com/blog/2009/03/18/building-fast-client-side-searches/" rel="noreferrer">flickr blog post</a> discusses the thought behind their latest improvements to the people selector autocomplete.</p>
  
  <p>One problem they had to overcome was how to parse and otherwise handle so much data (i.e., all your contacts) client-side. They tried getting XML and JSON via AJAX, but found it too slow. They then had this to say about loading the data via a dynamically generated script tag (with callback function):</p>
  
  <blockquote>
    <h2>JSON and Dynamic Script Tags: Fast but Insecure</h2>
    
    <p>Working with the theory that large
    string manipulation was the problem
    with the last approach, we switched
    from using Ajax to instead fetching
    the data using a dynamically generated
    script tag. This means that the
    contact data was never treated as
    string, and was instead executed as
    soon as it was downloaded, just like
    any other JavaScript file. The
    difference in performance was
    shocking: 89ms to parse 10,000
    contacts (a reduction of 3 orders of
    magnitude), while the smallest case of
    172 contacts only took 6ms. The parse
    time per contact actually decreased
    the larger the list became. This
    approach looked perfect, except for
    one thing: in order for this JSON to
    be executed, we had to wrap it in a
    callback method. <strong>Since it’s executable
    code, any website in the world could
    use the same approach to download a
    Flickr member’s contact list.</strong> This was
    a deal breaker. (emphasis mine)</p>
  </blockquote>
  
  <p>Could someone please go into the exact security risk here (perhaps with a sample exploit)? How is loading a given file via the "src" attribute in a script tag different from loading that file via an AJAX call?</p>