Collected research
Fun with data: URLs
Notes that data: URLs bypass anti-XSS filters, and in Firefox and Opera a document opened from one keeps access to the opening page, so a single link yields XSS. Fuzzing the data: URI syntax found parsers that accept junk after the base64 token, a stray colon, embedded whitespace or a doubled comma. A table records which ASCII bytes each of four browsers tolerates.
Record
- Published by
- blog.kotowicz.net
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of blog.kotowicz.net, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .