News for hackers. Stuff that matters.

A comment on HTML5 Sandbox - a bad idea. Parent comment

Re:HTML5 Sandbox - a bad idea by tptacek on Saturday April 06, 2013 @02:01PM (#5504381)
Read the paper I posted up thread.
[ Parent | on HN ]
Re:HTML5 Sandbox - a bad idea by homakov on Saturday April 06, 2013 @02:38PM (#5504528)
Table 2: Frame busting conditional statement

we consider following tricks:

document.write('')

setTimeout(function(){document.body.innerHTML='';},1);

window.self.onload = function(evt){document.body.innerHTML='';}

None of them was bypassed further in the paper. (I used Ctrl+F)

[ Parent | on HN ]
Re:HTML5 Sandbox - a bad idea by homakov on Saturday April 06, 2013 @02:34PM (#5504511)
double checked http://seclab.stanford.edu/websec/framebusting/framebust.pdf there are many parent-navigation bypasses in this paper but nothing for innerHTML='' (not taking into account sandbox and xss auditor)
[ Parent | on HN ]