javascript: protocol security violations

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Dom Leonard
    #1

    javascript: protocol security violations

    Hi all,

    I occasionally use the javascript protocol in window.open to retrieve a
    window property of the opener for use as HTML source:

    window.htmlSrc= "<html>...b lah ....<\/html>";
    window.open("ja vascript:opener .htmlSrc", testWindow);

    The technique was absolutely needed in NS4.xx to overcome reentrancy
    problems with document.writin g to generated windows, and has been useful
    for testing and some cross browser DHTML work since.

    Currently Opera 7.11 refuses to honor the protocol with a security
    violation errror, Mozilla has been refusing to allow window reload from
    the generated window for some time, and Moz 1.4 is generating
    informative security warnings. Basically it looks like the javascript
    protocol is about to become dead sooner rather than later.

    Does anyone else consider this security error a result of simplistic
    treatment of the javascript protocol when implimenting same domain policy?

    Are there real security issues with the javascript protocol that are
    additional to being able to execute window.open on somebody else's
    domain sourced page in the first place?

    Does anyone care or should we just let it die?


    Personally I would prefer to see the javascript: protocol standardised
    rather than discarded, but that much may be obvious! :)

    Cheers,
    Dom




    Tags: None
    • Jim Ley
      #2
      Re: javascript: protocol security violations

      On Sun, 20 Jul 2003 12:03:58 +0930, Dom Leonard
      <doml.removethi s@senet.andthis .com.au> wrote:
      [color=blue]
      > Basically it looks like the javascript
      >protocol is about to become dead sooner rather than later.[/color]

      It was never really alive for doing this kind of stuff IMO.
      [color=blue]
      >Does anyone else consider this security error a result of simplistic
      >treatment of the javascript protocol when implimenting same domain policy?[/color]

      Perhaps, but the problem is there have been hundreds of security holes
      built around using javascript protocol, since there's no sane reason
      for wanting to do it, it will be generally unreliable, and it will
      remove some of the holes without having to think, it seems to make
      sense that they've disabled it.
      [color=blue]
      >Personally I would prefer to see the javascript: protocol standardised
      >rather than discarded, but that much may be obvious! :)[/color]

      Then take it to the IETF... You have as much right as anyone else. a
      javascript uri scheme registration wouldn't appear to be tough to
      write...

      Jim.
      --
      comp.lang.javas cript FAQ - http://jibbering.com/faq/

        Comment

        Previous template Next
        Working...