Closed Bug 661671 Opened 15 years ago Closed 15 years ago

XSS in "Using nsIAccessible in Javascript"

Categories

(www.mozilla.org :: General, defect)

Product:
www.mozilla.org
Component:
General
Platform:
Other
Other
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED INVALID

People

(Reporter: ygjb, Unassigned)

References

(
URL
)

Details

(Whiteboard: [infrasec:xss][ws:low])

Issue Potential XSS in the jstest page for nsIAccessible. Steps to reproduce http://www.mozilla.org/access/qa/jstest http://www.mozilla.org/access/qa/linetest/jstest.html field "Test document" input javascript:alert() and pressed key Enter to executed xss Recommendation No action. This is not a feasible attack vector.
This issue was reported by ignatio2007@gmail.com At http://www.mozilla.org/access/qa/jstest there is a website that allows a user to interactively test some javascript features. In order for an attacker to leverage this, they need to get a user to type or paste in malicious content into the textbook and hit enter to get a reflected javascript.
URL: http://www.mozilla.org/access/qa/jstest
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → INVALID
Whiteboard: [infrasec:xss][ws:low]
There's no "X" (cross-site) in this XSS -- this is the user running code against themselves. Does not qualify for the web bounty.
Component: www.mozilla.org → General
Product: Websites → www.mozilla.org
You need to log in before you can comment on or make changes to this bug.