Comments on: FBJS-Like test console

by: Peter Goodman

Tue, 15 Jan 2008 04:46:14 +0000

There seems to be a problem when dealing with inline regular expressions where it treats everything with / and / as normal variables.

Fri, 04 Jan 2008 03:15:00 +0000

Thank Peter, I had written my codes and your codes should be handled correctly now.

Please keep me posted if you find any malicious codes.

:-D

Fri, 04 Jan 2008 01:17:15 +0000

Here is a less convoluted example:

(function(){
// ‘this’ is the window object
alert(this);
})();

Fri, 04 Jan 2008 00:59:03 +0000

I have found another hole:

(”".prototype = function() {
this[”eval”](”alert(’hello world.’)”);
})();

Unless of course, when it displays the around a string that means something. Also, if a normal variable ‘prototype’ is used, it is not filtered.

Thu, 03 Jan 2008 19:53:34 +0000

Thanks, it’s fixed now

Thu, 03 Jan 2008 06:05:26 +0000

It seems to screw up on:
eval(”alert(’hello world’);”);

producing:
SANDBOX_eval(”alert(’SANDBOX_hello SANDBOX_world’);”);

Also, it fails to stop the following possible exploit (for IE):
//@cc_on eval(”alert(’hello world’);”)

Otherwise, very cool!