XSS

Talk about code development, features, specific bugs, enhancements, patches, and similar things.
Forum rules
Please keep everything here strictly on-topic.
This board is meant for Pale Moon source code development related subjects only like code snippets, patches, specific bugs, git, the repositories, etc.

This is not for tech support! Please do not post tech support questions in the "Development" board!
Please make sure not to use this board for support questions. Please post issues with specific websites, extensions, etc. in the relevant boards for those topics.

Please keep things on-topic as this forum will be used for reference for Pale Moon development. Expect topics that aren't relevant as such to be moved or deleted.
Locked
User avatar
fixmen
Hobby Astronomer
Hobby Astronomer
Posts: 26
Joined: 2019-12-23, 16:08

XSS

Unread post by fixmen » 2020-09-04, 12:21

how protect pale moon for this attacks?

https://github.com/0xsobky/HackVault/wi ... S-Polyglot
Top
User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35602
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:
Contact Moonchild

Re: XSS

Unread post by Moonchild » 2020-09-04, 12:57

Why do you think Pale Moon is vulnerable to this?
You think the browser executes javascript in cookie headers? :D
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
Top
User avatar
adesh
Board Warrior
Board Warrior
Posts: 1277
Joined: 2017-06-06, 07:38

Re: XSS

Unread post by adesh » 2020-09-04, 13:32

On a related note:

Browser won't execute JavaScript in cookies directly but some sites transport JS functions and data via cookies (which are sometimes flagged/removed by various tools and proxies) later to eval them in the browser. This may not constitute an XSS and is not frequent, but I have seen this in experience a few times.
Top
User avatar
fixmen
Hobby Astronomer
Hobby Astronomer
Posts: 26
Joined: 2019-12-23, 16:08

Re: XSS

Unread post by fixmen » 2020-09-04, 17:14

ok thanks for the answer.
Top
User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35602
Joined: 2011-08-28, 17:27
Location: Motala, SE
Contact:
Contact Moonchild

Re: XSS

Unread post by Moonchild » 2020-09-04, 21:39

fixmen wrote: ↑
2020-09-04, 17:14
 ok thanks for the answer.
You didn't answer MY question though.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite
Top
Locked

Return to “Browser Development”