245857 - document.write can write to loaded document

Status: RESOLVED DUPLICATE of bug 243392

(Core :: Security, defect)

Description

[Met - Martin Hassman]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; cs-CZ; rv:1.7) Gecko/20040514
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; cs-CZ; rv:1.7) Gecko/20040514

When the page is loaded very slowly and the user click on some link, Mozilla can
execute document.writeln() from the first location in the second location.


The good and every times workign example of one Czech blogger is here
http://www.chose.cz/mozilla-js-test/
But because it is in Czech, I have create EN example
http://www.penguin.cz/~met/pub/bug/loc.php (the script delayes are by the php
sleep() fucntion) - but unfortunatelly it does not working for 100% - only
sometimes ;-( - propably it depends on the delays, I don't know.

Reproducible: Always
Steps to Reproduce:
1. Load http://www.penguin.cz/~met/pub/bug/loc.php
2. Click on the link before the page is loaded
3. In the new page look for the text 'Something written from the loc1.php'
and
4. If this does not work try the same on http://www.chose.cz/mozilla-js-test/
(but it is in Czech).

Comment 1

[Peter Van der Beken [:peterv]]

Please try a recent nightly.

*** This bug has been marked as a duplicate of 243392 ***