Re: [WEB SECURITY] Why JSON/JavaScript hijacking only works on Mozilla

[Daniel Veditz <dveditz@xxxxxxxxxx>]

Daniel Veditz wrote:
> Billy Hoffman wrote:
>> Well I figured out how to hijack without Mozilla-specific extensions,
>> but I still couldn’t hijack IE. The fundamental limitation (Protection?
>> Feature? Bug?) is that all other JavaScript interpreters do not call a
>> constructor function when parsing literals.
> 
> The ECMA 262 Edition 3 spec says to
> 
> 11.1.4.1. Create a new array as if by the expression |new Array()|.
> 11.1.5.1. Create a new object as if by the expression |new Object()|.

We've proposed changing the Edition 4 spec to match the actual behavior of
most implementations:

http://bugs.ecmascript.org/ticket/164


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]