Nice one. I thought behaviors like these were already fixed, but I was wrong :D
Certainly something to add to BeEF. Pity I will not be at HITB. Cheers antisnatchor On Wed, May 16, 2012 at 6:29 PM, Nicolas Grégoire <nicolas.grego...@agarri.fr> wrote: > >> Uploading a SVG chameleon (SVG file triggering a XSLT >> transformation) to a website allows to display nearly arbitrary >> content if the file is called directly. > > In order to demonstrate this point _and_ the weird Opera behavior, I put > online a SVG chameleon and a HTML file calling it via <img>: > http://www.agarri.fr/docs/svg2html.svg > http://www.agarri.fr/docs/svg2html.html > > If the chameleon is called directly, Opera, Firefox and Webkit (IE > untested) execute the HTML Javascript code located in the output > document. Look at the DOM, there's no more reference to the source SVG > file anymore. > > If the chameleon is called via <img>, only Opera renders the HTML output > (without executing the Javascript). I didn't test if the inter-documents > behavior is similar to the (i)frames one ... Screen-shot: > http://www.agarri.fr/docs/opera-chameleon.png > > <shameless advertising>I'll demonstrate some additional XML/XSLT/SVG/... > tricks at Hack in the Box Amsterdam next week</shameless advertising> > > Nicolas > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ -- /antisnatchor _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
