Posted in XSS Info on July 30th, 2010 by Gareth Heyes
We have a new challenge!
http://www.businessinfo.co.uk/labs/DomAPI/DomAPI.html
Can you break my DOM sandbox?
More info here:-
http://www.thespanner.co.uk/2010/07/30/sandboxed-dom-api/
It isn't a complete DOM yet but stuff like getElementById, firstChild etc should work. You can set attributes on the HTML element, a onclick event and styles. Past exploits include:-
//Code is already sandboxed so strings would execute (now fixed)
document.getElementById('x').onclick='alert(location)';
//attributes weren't being checked for evil url assignments
document.getElementById('x').onclick=function() { this.href='javascript:alert(location)';}
Have fun!
