Re: A perfect DOM sandbox

On 16 February 2011 11:30, Giorgio Maone <g.maone@informaction.com> wrote:

> Not necessarily.
>
> Try
>
> var doc = docImpl.createDocumentType("html", "", ""));
> var body = doc.createElement("body");
> body.innerHTML="<img src=x onload=alert(1) onerror=alert(1)>"
>
>
> NoScript uses tricks like these to take in account out fancy and forgiving
> HTML parsing in its XSS filter :)
>

I think the createElement bit is broken in firefox, when you assigned to
innerHTML it executes without assigning the doc to the dom.