3 ms·
That's not at all what's happening here. It doesn't even have anything to do with input fields, except that the field in the HTTP request that stores the inform
by chmod775 5y ago
That's not at all what's happening here. It doesn't even have anything to do with input fields, except that the field in the HTTP request that stores the information on Apple's servers was supposed to be filled from one.
This kind of attack essentially tricks Apple into including arbitrary HTML/JavaScript in the webpage that shows information when someone scans the tag. There's no reliable way a browser could even know something untoward was happening.
- chrisjc 5y agoAh! I was actually struggling to understand how inputs had anything to do with it. I thought the input was being rendered with some pre-populated/injected value that in this case was the script. <input><script.../></input> Then again, if they were able to inject something into the input, chances are they could inject it anywhere, so as you said it has nothing to do with input fields. Thanks for the clarification.