3 ms·
Users shouldn't be able to alias anything to RunScript. Much less alias RunScript to RemoveExtraSpaces or other functions which are called by the core. This is
by Raphmedia 10y ago
Users shouldn't be able to alias anything to RunScript. Much less alias RunScript to RemoveExtraSpaces or other functions which are called by the core. This is a big big big security fail.
Yes, this bug involve some social engineering but the bug itself is big. This is not a bug but a really bad oversight. If someone made it so that the field of a website's form called eval() directly we would all be pointing fingers right now. This bug is the exact same thing.
- plorkyeran 10y agoYou can make every website in existence call eval() directly on the contents of a form field if you persuade the user to paste some arbitrary text into the developer tools. The attack here happened to involve hooking an internal helper function, but that hook was in no way necessary for the attack; it could have instead just registered for the incoming chat text event and called eval() on it there.