4 ms·
what on earth has happened with engadgets url structure? tried (albeit briefly) to re-write it to get to the desktop version, failed a couple of times before i
by 5h 15y ago
what on earth has happened with engadgets url structure?
tried (albeit briefly) to re-write it to get to the desktop version, failed a couple of times before i spotted the desktop link at the bottom, which looks to append ?m=false, and now the first piece of content in the body element is the word "false", presumably debugging stuff, hope that's sanitised properly!
- StavrosK 15y agoIt's not: http://www.engadget.com/2012/03/01/foursquare-replaces-google-maps-with-openstreetmap-mapboxstreets/?m=%3Cscript%3Ealert(3)%3C/script%3E http://www.engadget.com/2012/03/01/foursquare-replaces-googl... Interestingly, Chrome doesn't execute that because it finds the source of the script in the request. Good XSS avoidance idea.
- JeremyBanks 15y agoThey escape single- and double-quotes, what else is there to worry about?
- 5h 15y agoI tried that in chrome too, saw it didnt work and presumed the site handled it, not my browser, IE9 avoids it as well, even shows a little popup saying the site has been modified to prevent xss, latest FF still displays the alert though.