Re:Hacking Github with Webkit
by underwater on Saturday March 09, 2013 @04:11PM
(#5349651)
What you're referring to is a self-XSS. They were a lot more common back when you could run JavaScript from the address bar.
These days if you try and paste JavaScript to your address bar (try it with: javascript:alert(1);) then the browsers try and stop you. Firefox just won't execute any JavaScript, even if you've manually typed it. IE and Chrome strip the "javascript:" prefix (but Chrome is vunerable if you type "j" and paste the remainder).
These days if you try and paste JavaScript to your address bar (try it with: javascript:alert(1);) then the browsers try and stop you. Firefox just won't execute any JavaScript, even if you've manually typed it. IE and Chrome strip the "javascript:" prefix (but Chrome is vunerable if you type "j" and paste the remainder).
More info here: https://www.facebook.com/photo.php?v=956977232793