-
Notifications
You must be signed in to change notification settings - Fork 68
window.name source
Ohpe edited this page Jan 29, 2016
·
1 revision
Characters in window.name
value are invariant to the way they have been given. Which means that if a JavaScript application sets:
window.name='a\x01b'
no encoding is applied.
window.name
attribute is always a cast to the string representation of the object it is assigned to.
The window.name
attribute is a persistent value during the existence of the page to which is assigned.
An attacker can set new windows names and frames with no restriction, and they will persist during navigation on any domain.
- Home
- Sources
-
Sinks
- Direct Execution Sinks
- Set Object Sinks
- HTML Manipulation Sinks
- Style Sinks
- XMLHttpRequest Sink
- Set Cookie Sink
- Set Location Sink
- Control Flow Sink
- [Use of Equality And Strict Equality](Use of Equality And Strict Equality)
- Math.random Sink
- JSON Sink
- XML Sink
- [Common JavaScript libraries](Common JavaScript libraries)
- String Manipulation Methods
- Local DOMXSS
- Finding DOMXSS
- Object Shadowing
- Filters
- Glossary
- References