At first glance there it missed "vbscript:"? On Sat, Jul 4, 2009 at 1:07 AM, Michal Zalewski<lcamtuf@xxxxxxxxxxx> wrote: >> refresh: 0; URL=javascript:alert(document.cookie) >> The code will work in context of this site. > > ...which happens to be covered here for half a year or so: > http://code.google.com/p/browsersec/wiki/Part2#Redirection_restrictions > > I can't see how this could be a vulnerability per se, although > changing the behavior offers an additional, if small, degree of > protection in case of security lapses in web applications, so it's a > reasonable improvement. > > Cheers, > /mz >
