* Simon Pieters wrote: >This makes window.onerror rather useless for cross-origin scripts. >However, it is still possible to tell if the user is logged in or not if a >site serves a script for a particular URL when the user is logged in and >redirects to the home page or so when the user is not logged in. We have >found a bank site where this is possible. There are other ways to tell if >the user is logged in, however it seems we should try to keep them to a >minimum. Therefore we suggest that window.onerror should not be invoked at >all for errors in cross-origin scripts.
I note there are at least two other ways to minimize the disclosure pro- blem here, which is due to a bug on the bank's site, and it seems quite likely there should be many more ways to check whether the script loaded (like checking for global variables it sets, markup it might add, mess with event listeners it might register, and so on): limit this to the "cookie domain" and basing the decision on the media type of responses. Either would disclose more, but taking away the ability to issue alerts when there are too many scripting errors (new browser update pushed to users that you did not catch in advance is incompatible with script, as an example) short of having people add "script_xy_loaded_okay" data to the scripting environment, which might be a new source of leaks when it is used incorrectly, is a bit of a problem, even if the rule that you do not get errors from "cross-origin" loads is certainly the most simple. -- Björn Höhrmann · mailto:bjo...@hoehrmann.de · http://bjoern.hoehrmann.de Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de 25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/