4 ms·

Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass th

Web browsers had had the capability to execute javascript through the URL bar since as long as I can remember. Social engineers should be able to just bypass this by telling users to copy paste the following code, Control+L, type "javascript:" (chrome strips it when copy-pasting), Control+V, Enter. javascript:alert('hi ' + document.body.innerHTML); If people can be tricked into executing code in the dev console, then why not this too?

dorward 13y ago
Browsers have already started to remove/limit code execution capability from the address bar. https://bugzilla.mozilla.org/show_bug.cgi?id=656433 https://bugzilla.mozilla.org/show_bug.cgi?id=656433 https://code.google.com/p/chromium/issues/detail?id=82181 https://code.google.com/p/chromium/issues/detail?id=82181
- EGreg 13y ago
  Wait does this mean bookmarklets will fail in those browsers from now on?
  - shdon 13y ago
    My bookmarklets run just fine, JS in the URL-bar doesn't.
    - EGreg 13y ago
      Do the bookmarklets execute in the context of the page?
      - shdon 13y ago
        Yes, they work just as they've always done.
    - Bwoup 13y ago
      But bookmarklets execute via the URL bar, that's all they are...
Ellipsis753 13y ago
That no longer works in newer Firefox (and I think Chrome?). You can turn that back on in about::settings though. edit: Ooops, someone had already made a post to this effect. Sorry.
- tokenizerrr 13y ago
  I tested it in Chrome before posting. Notably it removes the javascript: from the clipboard, but that's why I said to have the user type that part.
robocat 13y ago
I think (Chrome & Firefox) you can use a content security policy to prevent JavaScript running from the address bar: http://en.wikipedia.org/wiki/Content_Security_Policy http://en.wikipedia.org/wiki/Content_Security_Policy