Hacking the &lt;a&gt; tag in 100 characters

Re:Hacking the <a> tag in 100 characters by lukifer on Sunday March 17, 2013 @12:57PM (#5389933)

While this should probably be fixed as prescribed by the author, it's relatively easy for a no-goodnik to accomplish the same goal without touch the href:

  $("a").click(function(e){
    e.preventDefault();
    document.location="http://evilsite.paypa1.com";
  });

In either case, a right-click to open or copy/paste sidesteps, though that's just a kludge.

[ Parent | on HN ]

Re:Hacking the <a> tag in 100 characters by devinblais on Sunday March 17, 2013 @05:26PM (#5391131)

I think this is an important point. The fact that you can change the href after the click is irrelevant because there are other (just as easy) ways to change where the link will be taking the user. If malicious javascript is being run on your page, THAT is your problem, not the href switch.

[ Parent | on HN ]

Re:Hacking the <a> tag in 100 characters by victorcsiky on Sunday March 24, 2013 @06:44AM (#5431678)

I've just came here to post this exact notice.

Thus You cannot just "warn users if the location of a link changes to a different domain after they click on it".

That said, this is probably a "wontfix".

Also, nowadays, the whole purpose of SSL certificates is actually doomed due to the "growth" - that is, rogue business people for profit without actual verification. In the beginning, one needed to fax in whole incorporation certificates and the like. Now, it is just like You pay for it, then maybe They phone You, maybe not.

[ Parent | on HN ]