Closed
Bug 77503
Opened 25 years ago
Closed 14 years ago
possible to set window.toString for another domain
Categories
(Core :: Security: CAPS, defect)
Tracking
()
RESOLVED
WORKSFORME
Future
People
(Reporter: jruderman, Assigned: dveditz)
Details
Typing this sequence of URLs into my homepage lets me set the toString for a
window at www.amazon.com. This doens't look exploitable, since "alert
(document.links.length);" is evaluated on my homepage (even if window.toString
is called from the amazon window).
javascript:x = window.open('http://www.amazon.com/'); void(0);
javascript:x.toString = function () { alert(document.links.length); }; void(0);
javascript:alert(x);
|
||
Comment 1•25 years ago
|
||
As this is not exploiatable, let's put it aside for now.
Status: NEW → ASSIGNED
Target Milestone: --- → mozilla1.0
|
Reporter | |
Comment 2•25 years ago
|
||
Similar to bug 86028, can redefine focus() and other allAccess functions at
another domain.
|
|
||
Comment 3•24 years ago
|
||
Less important bugs retargeted to 0.9.9
Target Milestone: mozilla1.0 → mozilla0.9.9
|
|
||
Updated•24 years ago
|
Target Milestone: mozilla0.9.9 → Future
|
|
Reporter | |
Updated•21 years ago
|
Assignee: security-bugs → dveditz
Status: ASSIGNED → NEW
QA Contact: ckritzer
|
||
Updated•17 years ago
|
QA Contact: caps
|
|
Reporter | |
Comment 4•14 years ago
|
||
> x.toString = function () { alert(document.links.length); }; void(0);
Error on line 1: Permission denied to access property 'toString'
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•