News for hackers. Stuff that matters.

A comment on Apple.com XSS attack. Parent comment

Re:Apple.com XSS attack by willwagner on Tuesday November 03, 2009 @06:40PM (#920530)
It allows you to put javascript in a click handler:

http://www.apple.com/itunes/affiliates/download/?artistName=...

[ Parent | on HN ]
Re:Apple.com XSS attack by adrinavarro on Tuesday November 03, 2009 @06:45PM (#920539)
I was wrong, you're right! Now that's medium-insecure. But still not to panic at this, just XSS and client-side (everything is inserted by JS). Well, there are worst things, right? :)
[ Parent | on HN ]
Re:Apple.com XSS attack by chrisbroadfoot on Tuesday November 03, 2009 @07:46PM (#920623)
"just" XSS?
[ Parent | on HN ]
Re:Apple.com XSS attack by NathanKP on Tuesday November 03, 2009 @06:46PM (#920541)
On Safari the click handler works but the image just shows up as an error, not a "Click Me" message.
[ Parent | on HN ]