Closed
Bug 1035090
Opened 12 years ago
Closed 12 years ago
make -moz-document useless for scriptless attacks
Categories
(Core :: CSS Parsing and Computation, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 1035091
People
(Reporter: freddy, Unassigned)
Details
Scriptless attacks (i.e. CSS injections) can be used to leak secret data in the URL (session id, oauth token) to a third party.
If we would remove -moz-document completely, this would not be possibly.
Alternatively, we could also stop supporting -moz-document for web content. Or we could just remove the regex feature.
Explanation of scriptless attacks: http://www.nds.rub.de/research/publications/scriptless-attacks/
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•