Re: Browser bugs hit IE, Firefox today (SANS)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 7/4/06, Thor Larholm <thor@xxxxxxxxxxxx> wrote:
However, reading the contentDocument property of the DOM element instead
of the through the frames collection will give you a reference to the
document object inside the thirdparty domain and even allow you to
overwrite native DOM methods without throwing a security exception, such
as
document.getElementById("thirdparty").contentDocument.getElementById=function(s){alert(s)}.


This code throws an exception in Firefox 1.5.0.4:
"Error: uncaught exception: Permission denied to set property
HTMLDocument.getElementById
"

Just obtaining a reference to the contentDocument works, but any
action on it throws an error.

[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux