4 ms·

Same experience with IE bug-reporting here. I reported a bug in May 2015, put up a little example page in order to show them the problem: http://bjarneh.github

Same experience with IE bug-reporting here. I reported a bug in May 2015, put up a little example page in order to show them the problem: http://bjarneh.github.io/ie/index.html http://bjarneh.github.io/ie/index.html Strange bug where input fields added to the DOM containing non-ASCII characters (whether you escape them or not) trigger 'input' events. So the example page loaded in IE will already have triggered 2 'input' events, since the last 2 input-elements contain the letter 'å' (escaping it as å makes no difference). After getting through the trouble of submitting the bug, nothing happened. About 6 months later I got an email saying the ticket was closed; as they were not able to reproduce the bug. The bug is still here today 5 years later.

qz2 6y ago
I feel for you. At least it’s good to know that IE11 is likely to die before we do at the moment :)
- bjarneh 6y ago
  The sad news was that this browser was the recommended browser to use inside the company as it worked best with "Sharepoint". Basically a total hack was required for every AJAX request that could return input fields with non-ASCII characters, as the page itself listened for input events on these elements. I.e. we basically have to wait for the AJAX-elements to be added to the DOM (removing any 'input' listener as they are), then add the same event-listeners again after every AJAX-call etc, not exactly an elegant solution...
tinus_hn 6y ago
If that event appears as user interaction you might be able to make a minor vulnerability out of it, instance to create pop-ups without interaction.
- bjarneh 6y ago
  Yes that should be possible. Unfortunately I was in the opposite position, i.e. I had to make this browser look normal by hiding all of its misbehaviors, not try to exploit them :-)
  - tinus_hn 6y ago
    Yes but if you can find a way to exploit it you can file it as a security issue and get Microsoft to fix it or even pay you!
    - bjarneh 6y ago
      Ah, that's the loophole in Microsoft's bug-reporting. It's not just hard to file bug-reports, you have to find ways to exploit every bug in a way that make them security issues :-) > and get Microsoft to fix it or even pay you! That would be nice...

qz2 6y ago

I feel for you. At least it’s good to know that IE11 is likely to die before we do at the moment :)

bjarneh 6y ago
The sad news was that this browser was the recommended browser to use inside the company as it worked best with "Sharepoint". Basically a total hack was required for every AJAX request that could return input fields with non-ASCII characters, as the page itself listened for input events on these elements. I.e. we basically have to wait for the AJAX-elements to be added to the DOM (removing any 'input' listener as they are), then add the same event-listeners again after every AJAX-call etc, not exactly an elegant solution...

tinus_hn 6y ago

If that event appears as user interaction you might be able to make a minor vulnerability out of it, instance to create pop-ups without interaction.

bjarneh 6y ago
Yes that should be possible. Unfortunately I was in the opposite position, i.e. I had to make this browser look normal by hiding all of its misbehaviors, not try to exploit them :-)
- tinus_hn 6y ago
  Yes but if you can find a way to exploit it you can file it as a security issue and get Microsoft to fix it or even pay you!
  - bjarneh 6y ago
    Ah, that's the loophole in Microsoft's bug-reporting. It's not just hard to file bug-reports, you have to find ways to exploit every bug in a way that make them security issues :-) > and get Microsoft to fix it or even pay you! That would be nice...