Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome

[Liu Die Yu]

At first glance there it missed vbscript:?

On Sat, Jul 4, 2009 at 1:07 AM, Michal Zalewskilcam...@coredump.cx wrote:
 refresh: 0; URL=javascript:alert(document.cookie)
 The code will work in context of this site.

 ...which happens to be covered here for half a year or so:
 http://code.google.com/p/browsersec/wiki/Part2#Redirection_restrictions

 I can't see how this could be a vulnerability per se, although
 changing the behavior offers an additional, if small, degree of
 protection in case of security lapses in web applications, so it's a
 reasonable improvement.

 Cheers,
 /mz

Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome

[Michal Zalewski]

 refresh: 0; URL=javascript:alert(document.cookie)
 The code will work in context of this site.

...which happens to be covered here for half a year or so:
http://code.google.com/p/browsersec/wiki/Part2#Redirection_restrictions

I can't see how this could be a vulnerability per se, although
changing the behavior offers an additional, if small, degree of
protection in case of security lapses in web applications, so it's a
reasonable improvement.

Cheers,
/mz