Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet --Explorer, Opera and Chrome

From: Liu Die Yu <liudieyu.com@gmail.com>
To: Michal Zalewski <lcamtuf@coredump.cx>
Cc: MustLive <mustlive@websecurity.com.ua>,bugtraq@securityfocus.com
Subject: Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet --Explorer, Opera and Chrome
Date:


At first glance there it missed "vbscript:"?

On Sat, Jul 4, 2009 at 1:07 AM, Michal Zalewski<lcamtuf@coredump.cx> wrote:
>> refresh: 0; URL=javascript:alert(document.cookie)
>> The code will work in context of this site.
>
> ...which happens to be covered here for half a year or so:
> http://code.google.com/p/browsersec/wiki/Part2#Redirection_restrictions
>
> I can't see how this could be a vulnerability per se, although
> changing the behavior offers an additional, if small, degree of
> protection in case of security lapses in web applications, so it's a
> reasonable improvement.
>
> Cheers,
> /mz
>





Copyright © 1995-2018 LinuxRocket.net. All rights reserved.