[Webkit-unassigned] [Bug 29278] XSSAuditor bypasses from sla.ckers.org

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=29278





--- Comment #3 from Mario Heiderich <mario.heiderich at gmail.com>  2009-09-15 16:32:09 PDT ---
(In reply to comment #2)
> Reduced copy of the recent post with the UTF-7/ISO filter circumvention:
> 
> <copy>
> Charset conversions are not handled right as it seems - and can be used to init
> the real payload. Will I get a cookie for this? ;)
> 
> <img%20src=ä%20onerror=alert('ä')> // alerts ä on a ISO-8859-1 encoded site
> 
> http://sla.ckers.org/forum/read.php?13,31377,31440#msg-31438
> </copy>

Sry - UTF-8

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.