2 ms·

The same with an absolute URL: <img src="jar:http://kaioa.com/b/0907/test.jar!/img1.png" alt="img1" width="32" height="32"/> my security sense is tingling

• fno 17y ago
  If you are thinking of local directory traversal (src="jar:http://kaioa.com/b/0907/test.jar!../../somefile http://kaioa.com/b/0907/test.jar!../../somefile) then I think you are underestimating browser coders. Introducing that security issue would require a dedicated effort.
  • there 17y ago
    no, i was thinking that in certain scenarios where it might be possible to control the name of the file being shown, using jar:http:// http:// could do a remote request and possibly expose some information.