Hi everybody.

Can anybody explain me why Opera and IE still allows reading of iframe with file:// src from the html of same protocol (whereas Firefox and Chrome forbids it)? Cause if user saves the page with such iframe locally and opens it, JS can read its innerHTML and send it anywhere.

P.S. Curious: local open of html file with <iframe src="file:///C:\WINDOWS\NOTEPAD.EXE"> in Safari Win leads to executing explorer.exe with C:\WINDOWS location. lol

---------
http://p0deje.blogspot.com

I think when you save the file it's marked as downloaded so it's restricted in certain ways on IE.

------------------------------------------------------------------------------------------------------------
"People who say it cannot be done should not interrupt those who are doing it.";
labs : [www.businessinfo.co.uk]
blog : [www.thespanner.co.uk]
Hackvertor : [hackvertor.co.uk]

IE changes iframe src to about:blank if saving as "Webpage, full". But saving it as "Webpage, only HTML" preservers src. Still, IE blocks JS by default.

I'm just curious, isn't "forbid reading of file://" security standard? Because Firefox and Webkit using it.

---------
http://p0deje.blogspot.com

Firefox has additional protections as well - it will only let you read files in the current directory and it will not give you directory listing, so you would need to know the filenames to read them.

----------------------------------------------------------
Don't forget our IRC: irc://irc.irchighway.net/#slackers
[kuza55.blogspot.com]