3 ms·
For the last one, instead of actually uploading a file, you can just put data:text/javascript,alert('test') after the hash.
by fastest963 10y ago
For the last one, instead of actually uploading a file, you can just put data:text/javascript,alert('test') after the hash.
- chadscira 10y agoI did data:text/javascript;base64,YWxlcnQoMSk= I didn't know you could do stuff like this (not for XSS) data:text/html,<script>alert(window.location)</script> Cool, you can store a whole website in a URL now.
- joshstrange 10y ago> Cool, you can store a whole website in a URL now. As long as it's shorter than ~2000 characters [0] [0] http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers http://stackoverflow.com/questions/417142/what-is-the-maximu...
- chadscira 10y agoSeems like in chrome you can go much higher! Here is a example of 5M data:text/html,<script>window.location='data:text/html,<!--'+new Array(5000001).join('a')+'!--><script>document.documentElement.innerHTML=window.location.protocol+\':\'+String(window.location).length;</'+'script>';</script> I tried 110Mb and it actually worked as well! I'm not sure about the real limit. You can store MASSIVE amounts of data in these things. It also seems to eventually break the url display and reverts to about:blank. It still retains protocol integrity though.
- 9point6 10y agoAh I didn't know you could have it without the base64 encoding. I did basically the same: data:text/javascript;base64,YWxlcnQoInRlc3QiKQ==
- et-al 10y agoThese are awesome, thanks.
- wybiral 10y agoGood idea. I solved that one by using a "protocol relative url" (omitting the http[s] part).
- pault 10y agoThis is why you should never embed user created SVGs in your site.
- nsgi 10y agoWhat if they're in an img tag?