Hmm, I wonder if this could backfire. If it's an <iframe>, couldn't GitHub insert code that framebusts? If it's some other mechanism, couldn't they block by referrer? If it's CORS, couldn't GitHub deny CORS requests? If it's a <script> tag, couldn't GitHub do some nasty XSS?
Edit: ooh, take a look at the more detailed look from insight-labs: http://insight-labs.org/?p=1682
It's XMLHttpRequest ($.ajax), but with dataType: "script". Looking at the jQuery docs (http://api.jquery.com/jquery.ajax/):
"script": Evaluates the response as JavaScript and returns it as plain text. Disables caching by appending a query string parameter, "_=[TIMESTAMP]", to the URL unless the cache option is set to true. Note: This will turn POSTs into GETs for remote-domain requests.
Oh dear. If GitHub can detect this, GitHub can basically XSS all sites using Baidu's analytics.
Edit 2: Oh, the insight-labs article says the attack has stopped.
Edit: ooh, take a look at the more detailed look from insight-labs: http://insight-labs.org/?p=1682
It's XMLHttpRequest ($.ajax), but with dataType: "script". Looking at the jQuery docs (http://api.jquery.com/jquery.ajax/):
"script": Evaluates the response as JavaScript and returns it as plain text. Disables caching by appending a query string parameter, "_=[TIMESTAMP]", to the URL unless the cache option is set to true. Note: This will turn POSTs into GETs for remote-domain requests.
Oh dear. If GitHub can detect this, GitHub can basically XSS all sites using Baidu's analytics.
Edit 2: Oh, the insight-labs article says the attack has stopped.