[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome

> refresh: 0; URL=javascript:alert(document.cookie)
> The code will work in context of this site.

...which happens to be covered here for half a year or so:

I can't see how this could be a vulnerability per se, although
changing the behavior offers an additional, if small, degree of
protection in case of security lapses in web applications, so it's a
reasonable improvement.