3 ms·
That's the point--who.is won't play music by itself. Its lookup of the DNS records of jaimehawkins.co.uk injected the music into the page.
by wittrock 12y ago
That's the point--who.is won't play music by itself. Its lookup of the DNS records of jaimehawkins.co.uk injected the music into the page.
- justin66 12y agoYeah... that was actually hugely annoying. A little warning maybe.
- hamburglar 12y agoHere's your warning: if you ever click on an HN link titled "<something> XSS", prepare for something annoying to happen.
- _RPM 12y agoOh I see. This makes sense. This doesn't seem challenging to prevent. A simple replacement of characters on the HTML entity table would have prevented this instead of putting arbitrary text onto standard output.
- 0x0 12y agoYep, missing that is what makes this an "XSS" :)
- finnn 12y agoCorrect. The purpose of this post is to demonstrate yet another class of website that does not validate user input.
- finnn 12y agoCorrect. The purpose of this post is to demonstrate yet another class of website that does not validate user input.