I have read this article about the CRIME attack against TLS and SPDY. The article says that:
What is not yet clear is how the attacker is including their input in the source material before it gets compressed and encrypted.
And this is my question: How does the attacker include their input before compression and encryption?
Also, I have the feeling that this is an inconsistency: If the attacker can insert their input before compression and encryption in TLS, isn't it necessary that the attacker is the real client itself?
Please explain what I am missing here in order to understand the CRIME attack.