4 ms·
Facebook should enforce that something along the lines of document.addEventListener('copy', function(e){/javascript:/.test(document.getSelection()+'') && e
by antimatter15 15y ago
Facebook should enforce that something along the lines of
document.addEventListener('copy', function(e){/javascript:/.test(document.getSelection()+'') && e.preventDefault();}, true)
be added to every facebook page (via the fbml sandbox or something to prevent users from copying bookmarklets as they are profoundly dangerous and do much more harm than good on a social networking site. (Note, that the above code is just a prototype, it's quite incomplete in that it doesn't support IE and probably leaves a gaping hole for someone to use clipboardData.setText)
- nbpoole 15y agoIE9 actually takes care of this to some degree. For example, try pasting javascript:alert(1) into your address bar and hitting enter: the Javascript is blocked. To bypass it, you need to paste part of the URL into the address bar and manually fill in the rest (specifically, you can't paste a URL starting with javascript: or vbscript:). To the best of my knowledge, IE9 is the only browser that implements this kind of protection. Two thoughts: 1. Disabling Javascript execution via the address bar is not something Facebook is capable of doing, any more than a random web developer can disable your ability to view the HTML of a page. Protection at this level is up to the browser developers. 2. That being said, I believe these kinds of phishing attacks demonstrate a lack of understanding on the part of end-users regarding what javascript: URIs can do. It's hard to protect users from themselves. ;-)
- rsoto 15y agoUh.. it still works. http://i.imgur.com/jQOwU.png http://i.imgur.com/jQOwU.png
- nbpoole 15y agoDid you type it in or copy/paste? Only copy/paste is blocked. Also, keep in mind this is a new feature in IE9. Edit: Just tested again on Windows 7. Pasting javascript:alert(1) caused the javascript: part of the URI to be stripped.