XSS: Extension Exposer

[yuri-kiss]

It just comes with the territory..

Some extensions like jgPrism and jgJavascript have evaluation blocks of which some are unsandboxed, even the control category has unsandboxed JavaScript evaluation.. I propose a fix in extension exposer, of which I have pull requested.

I think we should add a strict mode :3 #417

[jwklong]

each extension with unsandboxed javascript has checks built in which either give a prompt or just don't run
also the js ones in core categories just don't work

[yuri-kiss]

each extension with unsandboxed javascript has checks built in which either give a prompt or just don't run also the js ones in core categories just don't work

this is literally false???

[yuri-kiss]

did you even look at the change bro?

[jwklong]

runJavascript is sandboxed

[yuri-kiss]

thats still a very big excuse not to accept a blantant security fix, plus you can use extension exposer to tell them to unsandboxed -_-

[jwklong]

its not a security fix though cause its not fixing anything

[yuri-kiss]

its not a security fix though cause its not fixing anything

it literally is

[jwklong]

what is it fixing then

[yuri-kiss]

it literally says in the issue and pr, multiple issues, including the XSS which is very trivial to do..

[jwklong]

its not a xss if theres physical limits preventing it from doing so already

[yuri-kiss]

theres literally not, as i said they can be bypassed

[jwklong]

show me how you can bypass it then

[RedMan13]

remember to always alert the href when testing for xss