3 ms·
I'm not 100% sure, but I think the chrome console is essentially the same, but you needn't prepend with javascript: and it has like autocompletion and history a
by mkjones 15y ago
I'm not 100% sure, but I think the chrome console is essentially the same, but you needn't prepend with javascript: and it has like autocompletion and history and a bunch of other things. Not sure why anyone would legitimately use the address bar for js.
- jrockway 15y agoNot sure why anyone would legitimately use the address bar for js. Bookmarklets, like http://kathack.com/ http://kathack.com/.
- re 15y agoBrowsers can support bookmarklets without allowing javascript to be entered directly in the address bar.
- scotth 15y agoThen the attack shifts. The "security check" becomes, drag this link to your bookmark bar and click it.
- simonbrown 15y agoA solution to that for browser vendors: Don't let the user drag javascript links from iframes into the bookmark bar.
- jrockway 15y agoWhy let users do anything in their browser? What if someone tricks them into jumping out their window?
- newhouseb 15y agoMobile web browsers sadly don't have console access like this so the address bar is the only way to go (ignoring scripts like weinre).