[jQuery] Re: Any server status if use script tag for XSS?

2007-10-09 Thread Jacky
Thanks. After look into the getScript code, I tried to play around with the readyState of the script elements. script.onload = script.onreadystatechange = function(){ try{ document.body.innerHTML += "" + this.readyState + "";

[jQuery] Re: Any server status if use script tag for XSS?

2007-10-09 Thread Karl Swedberg
Hey Jacky, it can now. :-) from http://docs.jquery.com/Ajax/jQuery.getScript#urlcallback: "Before jQuery 1.2, getScript was only able to load scripts from the same domain as the original page. As of 1.2, you can now load JavaScript files from any domain." --Karl _ Karl Swe

[jQuery] Re: Any server status if use script tag for XSS?

2007-10-09 Thread Jacky
If I remember correctly, getScript can't do cross site. -- Best Regards, Jacky 網絡暴民 http://jacky.seezone.net On 10/9/07, Matt <[EMAIL PROTECTED]> wrote: > > Maybe you could attach an "onload" or "onerror" event to your html element > (script) ? > Anyway, jQuery has a home made method to let you

[jQuery] Re: Any server status if use script tag for XSS?

2007-10-09 Thread Jacky
If the server return something like 404/500 page, I guess it would cause a javascript error when browser try to evaluate, and the try-catch method could work. Timer would be a good idea, but to determine the time to wait would require some specific measure. -- Best Regards, Jacky 網絡暴民 http://jack

[jQuery] Re: Any server status if use script tag for XSS?

2007-10-09 Thread Scott Trudeau
I actually posted to the dev list about a similar issue (using JSONP, which is script-like). I'd like to put a short timer on the script calls and receive a timeout if the callback function fails to fire. Scott On 10/8/07, Jacky <[EMAIL PROTECTED]> wrote: > > Hi, > > I would like to call crossit

[jQuery] Re: Any server status if use script tag for XSS?

2007-10-09 Thread Matt
Maybe you could attach an "onload" or "onerror" event to your html element (script) ? Anyway, jQuery has a home made method to let you do this, cross-browser: See http://docs.jquery.com/Ajax/jQuery.getScript#urlcallback Matt 2007/10/9, Jacky <[EMAIL PROTECTED]>: > > Hi, > > I would like to call c