3 ms·
This is a nice demonstration, although I feel like it would be more useful to show that it works across domains (Which IMHO is the most important part).
by Retr0spectrum 10y ago
This is a nice demonstration, although I feel like it would be more useful to show that it works across domains (Which IMHO is the most important part).
- aji 10y agoYeah, having never heard of this before, I'm a little shocked. Can you access things like window.opener.document? Fortunately, tabs created by opening the link using the middle mouse button don't seem to have a useful window.opener. Guess I'll be more deliberate about that habit.
- yeldarb 10y agoDoes it actually work cross domain? That would really surprise me. Edit: if I understand correctly this only allows the opened page to navigate the opening page; it does not allow it to do anything else to the opener. Is that correct?
- aji 10y agoI don't know about the cross-domain case but on the same "domain" (file: protocol) I used the following two HTML files link.html: <a id="link" href="opener.html" target="_blank">Click</a> opener.html: <script>window.opener.document.getElementById("link").href = "https://google.com";</script> and sure enough the link was changed. If this works cross-domain, this is kind of a big deal, isn't it?
- Retr0spectrum 10y agoSee this comment for a cross-domain demo: https://news.ycombinator.com/item?id=11631810 https://news.ycombinator.com/item?id=11631810 It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.
- magicalist 10y agoyou cannot access the opener's document as aji's example does cross origin
- Retr0spectrum 10y agoSorry, I didn't read the comment carefully enough. I assumed we were still talking about window.opener.location (which can be modified across domains)