OLD | NEW |
| (Empty) |
1 CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from access
ing a frame with origin "http://localhost:8000". Protocols, domains, and ports m
ust match. | |
2 CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from access
ing a frame with origin "http://localhost:8000". Protocols, domains, and ports m
ust match. | |
3 CONSOLE MESSAGE: line 1: TypeError: 'undefined' is not an object (evaluating 'ta
rget.document.body') | |
4 This page opens a window to "", injects malicious code, and then uses window.ope
n.call to set its opener to the victim. The opened window then tries to scripts
its opener. | |
5 Code injected into window: | |
6 <script>function write(target, message) { target.document.body.innerHTML = messa
ge; } | |
7 setTimeout(function() {write(window.opener.top.frames[0], 'FAIL: XSS was allowed
.');}, 100); | |
8 setTimeout(function() {write(window.opener.top.frames[1], 'SUCCESS: Window remai
ned in original SecurityOrigin.');}, 200); | |
9 setTimeout(function() { if (window.testRunner) testRunner.globalFlag = true; },
300);</script> | |
10 | |
11 | |
12 -------- | |
13 Frame: '<!--framePath //<!--frame0-->-->' | |
14 -------- | |
15 This page doesn't do anything special. | |
16 | |
17 -------- | |
18 Frame: '<!--framePath //<!--frame1-->-->' | |
19 -------- | |
20 SUCCESS: Window remained in original SecurityOrigin. | |
OLD | NEW |