Skip to content

Commit

Permalink
Minor nits: use a string for js: url return; file name typo fix;
Browse files Browse the repository at this point in the history
  • Loading branch information
rwaldron committed Jan 19, 2018
1 parent 083c1ee commit ad4a48b
Show file tree
Hide file tree
Showing 7 changed files with 4 additions and 4 deletions.
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<!doctype html>
<iframe id="test" name="test"></iframe>
<form target="test" action="javascript:parent.verifyNavigation(false);1;"><!-- 'javascript: url' ending with a "1;" is intentional --></form>
<form target="test" action="javascript:parent.verifyNavigation(false);'1';"><!-- 'javascript: url' ending with a "'1';" is intentional --></form>
<a target="test" onclick="document.forms[0].submit();" href="call-verify-navigation.html">Test</a>
<script>
window.verifyNavigation = parent.verifyNavigation;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<!doctype html>
<iframe id="test" name="test"></iframe>
<form target="test" action="javascript:document.write(`<!-- this should not be successful --><script>parent.verifyNavigation(false);</script>`);1;"><!-- 'javascript: url' ending with a "1;" is intentional --></form>
<form target="test" action="javascript:document.write(`<!-- this should not be successful --><script>parent.verifyNavigation(false);</script>`);'1';"><!-- 'javascript: url' ending with a "'1';" is intentional --></form>
<a target="test" onclick="document.forms[0].submit();" href="call-verify-navigation.html">Test</a>
<script>
window.verifyNavigation = parent.verifyNavigation;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<!doctype html>
<iframe id="test" name="test"></iframe>
<form target="test" action="javascript:/*this should not be successful*/((e,n)=>{while(e()<n);parent.verifyNavigation(false);})(Date.now,Date.now()+4000);1;"><!-- 'javascript: url' ending with a "1;" is intentional --></form>
<form target="test" action="javascript:/*this should not be successful*/((e,n)=>{while(e()<n);parent.verifyNavigation(false);})(Date.now,Date.now()+4000);'1';"><!-- 'javascript: url' ending with a "'1';" is intentional --></form>
<a target="test" onclick="document.forms[0].submit();" href="call-verify-navigation.html">Test</a>
<script>
window.verifyNavigation = parent.verifyNavigation;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<!doctype html>
<iframe id="test" name="test"></iframe>
<form target="test" action="javascript:document.write(`<script>parent.verifyNavigation(false);</script>`);1;"><!-- 'javascript: url' ending with a "1;" is intentional --></form>
<form target="test" action="javascript:document.write(`<script>parent.verifyNavigation(false);</script>`);'1';"><!-- 'javascript: url' ending with a "'1';" is intentional --></form>
<a target="test" onclick="document.forms[0].submit();" href="call-verify-navigation.html?pipe=trickle(d2)">Test</a>
<script>
window.verifyNavigation = parent.verifyNavigation;
Expand Down

0 comments on commit ad4a48b

Please sign in to comment.