Secure Mode exposes 'window' as 'this'
Work submitted
Pull requests: 1
Contributors: 1
Level: Intermediate
On GitHub
Klipse is a Javacript plugin for embedding interactive code snippets in tech blogs. A simple client-side code evaluator pluggable on any web page: clojure, ruby, javascript, python, scheme, es2017, jsx, brainfuck, c++, reagent, lua, ocaml, reasonml, prolog, common lisp
More info >
Issue posted by:Â xsc
Description
Within the KLIPSE boxes at the blog post announcing secure mode, it's still possible to run e.g. the following Javascript snippets, exposing things secure mode is trying to hide:
this.document
this.eval("1+2")Even HTTP requests can be triggered:
var makeXhr = this.Function("return new XMLHttpRequest()");
var xhr = makeXhr.call(this);
...All this is possible because this is bound to window.
On GitHub
Klipse is a Javacript plugin for embedding interactive code snippets in tech blogs. A simple client-side code evaluator pluggable on any web page: clojure, ruby, javascript, python, scheme, es2017, jsx, brainfuck, c++, reagent, lua, ocaml, reasonml, prolog, common lisp
More info >
Issue posted by:Â xsc
Secure Mode exposes 'window' as 'this'
