2 ms·
But would this same solution work with this vulnerability? The server sets the first line of the response js to `while (true) ;` and the js handler that does th
by jonny_eh 13y ago
But would this same solution work with this vulnerability? The server sets the first line of the response js to `while (true) ;` and the js handler that does the eval just deletes the first line like so:
eval( responseJS.replace(/.*\n/, "") )
- homakov 13y agoYes
- simonw 13y agoThe exploit occurs when an evil third party site links to your script from a script tag - they can't modify the returned code before it is evaluated. Your own code running on the same domain (which fetches the code using XHR) can make the modification and hence execute the script.