Re: [WEB SECURITY] Why JSON/JavaScript hijacking only works on Mozilla

[Daniel Veditz <dveditz@xxxxxxxxxx>]

Billy Hoffman wrote:
> Well I figured out how to hijack without Mozilla-specific extensions,
> but I still couldn’t hijack IE. The fundamental limitation (Protection?
> Feature? Bug?) is that all other JavaScript interpreters do not call a
> constructor function when parsing literals.

The ECMA 262 Edition 3 spec says to

11.1.4.1. Create a new array as if by the expression |new Array()|.
11.1.5.1. Create a new object as if by the expression |new Object()|.



----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]