This repository was archived by the owner on Oct 8, 2021. It is now read-only.
This repository was archived by the owner on Oct 8, 2021. It is now read-only.
XSS with location.href behavior of some browsers #4787
Description
This bug differs from Issue #1990. I tested on Safari 5.1.7 for Windows, Safari Mobile(iOS 5.1.1).
The vector is:
http://l0.cm%[email protected]/demos/1.2.0-alpha.1/#//l0.cm/jqm
These browsers percent-decode "user:password@" part of location.href. I think XSS comes from this behavior.
FYI, this behavior is fixed as CVE-2012-3695 in Safari 6. See: http://support.apple.com/kb/HT5400
Metadata
Metadata
Assignees
Labels
No labels