3 ms·
The first thing to cross my mind when I saw this was XSS vulnerabilities. Presumably there's nothing to stop this page running JS?
by 3chelon 8y ago
The first thing to cross my mind when I saw this was XSS vulnerabilities. Presumably there's nothing to stop this page running JS?
- kenbellows 8y agoAssuming you can include JS in the file, I imagine it would only run if the file was being parsed as HTML at the moment, not when parsed as a JPEG. That's the main point here: this file can be interpreted in two ways, but the data in it is treated very differently and has different effects depending on the way it's currently interpreted.