Re:Target=“_blank” – the most underestimated vulnerability ever
by est on Monday December 23, 2019 @09:52PM
(#21869473)
It's interesting that Google is the only expected browser vender these days.
[ Parent
| on HN ]
Re:Target=“_blank” – the most underestimated vulnerability ever
by zamadatix on Monday December 23, 2019 @10:13PM
(#21869560)
Firefox was mentioned in the article, Safari isn't that interested in furthering the web, and Microsoft has thrown in the towel and skinned Chromium as many others. Not sure who else would have commented/been mentioned.
Re:Target=“_blank” – the most underestimated vulnerability ever
by mistersquid on Tuesday December 24, 2019 @08:08PM
(#21876041)
> Safari isn't that interested in furthering the web
On macOS 10.15.2 (19C57) using Safari 13.0.4 (15608.4.9.1.3), the proofs of concept mentioned in the article yield
> The previous tab is safe and intact. window.opener was null; mischief not managed!
Perhaps your dismissal of Safari is presumptive and mistaken.
Re:Target=“_blank” – the most underestimated vulnerability ever
by rs23296008n1 on Tuesday December 24, 2019 @06:50PM
(#21875721)
I think aspects of this should be fixed in the standards. Firefox should definitely fix it. Make it readonly or even non-readable by default when the child domain is different to parent. Have the parent decide.
Security issues need secure solutions, right?
I don't actually see the utility in allowing open access from child page to parent page, especially when cross-server is a factor. There are similar other issues that have been closed. Why not this one?