[wp-trac] [WordPress Trac] #33848: Protect against vulnerability in Netscape 4?

[WordPress Trac]

#33848: Protect against vulnerability in Netscape 4?
-------------------------+------------------------------
 Reporter:  dmsnell      |       Owner:
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  Awaiting Review
Component:  Security     |     Version:  trunk
 Severity:  normal       |  Resolution:
 Keywords:               |     Focuses:  performance
-------------------------+------------------------------

Comment (by dmsnell):

 So today I did something I never thought I'd do: install Netscape
 Navigator 4 inside Windows 95 inside Virtual Box. I was able to verify the
 behavior of this vulnerability and that it seems sterile in today's
 market.


 {{{
 <img src="&{alert('Vuln!')};">

 <script language="javascript">
 alert('Normal');
 </script>
 }}}

 The idea here is that the if the browser is vulnerable we will get the
 "Vuln!' alert and it will arrive first. Netscape Navigator 4.0 was the
 only browser I could get to even show the "Vuln!" alert.

 [[Image(https://cldup.com/Wy3NEQOMP8.png)]]

 A scattering of modern browsers can be seen at
 http://browsershots.org/http://dmsnell.wpsandbox.me/old_xss_vuln.html#

 Not even IE 3 was impacted by this.

 cc: @nacin

--
Ticket URL: <https://core.trac.wordpress.org/ticket/33848#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform