Comments on: Javascript protocol fuzzer and Opera http://www.thespanner.co.uk/2008/09/18/javascript-protocol-fuzzer-and-opera/ Javascript blog with messed up syntax inside Thu, 26 Jan 2012 01:38:34 +0000 hourly 1 By: Gareth Heyes http://www.thespanner.co.uk/2008/09/18/javascript-protocol-fuzzer-and-opera/#comment-1317 Gareth Heyes Thu, 18 Sep 2008 20:01:05 +0000 http://www.thespanner.co.uk/?p=225#comment-1317 Ah looks like a false positive :( The fuzzing code is correct, it checks the browser to see if the link protocol is javascript so Opera is reporting it is but then stops it from executing. Doh! <slaps self on head> Ah looks like a false positive :(
The fuzzing code is correct, it checks the browser to see if the link protocol is javascript so Opera is reporting it is but then stops it from executing. Doh!

<slaps self on head>

]]> By: Chris Weber http://www.thespanner.co.uk/2008/09/18/javascript-protocol-fuzzer-and-opera/#comment-1316 Chris Weber Thu, 18 Sep 2008 18:21:45 +0000 http://www.thespanner.co.uk/?p=225#comment-1316 Hey Gareth, I can't manually validate these that occur at position 10. I tried: <a href="javascript&#7944:alert('works')" >test</a> But that doesn't execute in Opera. The ones at position 0 did work however. I wonder if there's a false positive in your test: if(document.getElementsByTagName('a').item(i).protocol == 'javascript:') or if I'm doing something wrong? Hey Gareth, I can’t manually validate these that occur at position 10. I tried:

<a href=”javascript&#7944:alert(‘works’)” >test</a>

But that doesn’t execute in Opera. The ones at position 0 did work however. I wonder if there’s a false positive in your test:

if(document.getElementsByTagName(‘a’).item(i).protocol == ‘javascript:’)

or if I’m doing something wrong?

]]>