R
Ry Nohryb
I'm not sure if this is of any utility, but it seems that you can run
JS code -apparently at the global scope- by doing this:
location.href="javascript: alert(document.body.innerHTML);"
and the page won't be navigated away (as long as the result is ===
undefined). I've tried -evilnessly- to use it to bypass the SOP and
inject some code in an iframe, but it only works in Safari, and only
when the main page's protocol is file://.
I wonder if there's any useful application for this rather ugly thing.
JS code -apparently at the global scope- by doing this:
location.href="javascript: alert(document.body.innerHTML);"
and the page won't be navigated away (as long as the result is ===
undefined). I've tried -evilnessly- to use it to bypass the SOP and
inject some code in an iframe, but it only works in Safari, and only
when the main page's protocol is file://.
I wonder if there's any useful application for this rather ugly thing.
