Re: Hotmail security hole - injecting JavaScript using <IMG

[metal_hurlant () YAHOO COM (Metal Hurlant)]

On Tue, 04 Jan 2000, Kevin Hecht wrote:
> While Hotmail obviously has a filtering hole, should the browser
> manufacturers be on the hook here as well, given that javascript: URLs
> probably shouldn't be rendered at all by the <IMG> tag? While a
> JavaScript script may load an image on its own, I don't see why the
> script itself should be loaded and parsed from an <IMG> tag.

Netscape actually tries to parse the value returned by the script, so if your
script returns, for example, a valid XPM string, you'll get that image
displayed.

What could be useful would be a tag working like
<blockscript key=randompieceofdata>

</blockscript key=samepieceofdata>

anything between these tags would still get parsed as HTML, but with no script
hook working.
That way, filtering scripts out of untrusted HTML would become the browser
manufacturers responbility, and things would be a lot easier for everyone else.

Just dreaming,
Henri Torgemane