Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What's an example of a modification to DOM spec that introduces vulnerabilities? I'm not sure I'm familiar with any.


in MS Edge

document.cookie = 'secret=123'; const parser = new DOMParser(); const html = parser.parseFromString('', 'text/html'); console.log(html.cookie);

prints secret=123 because of an improperly implemented inheritance model. other browsers do NOT inherit cookies from main document as a result of following the spec closer




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: