Event.prototype.toString=[].join; Event.prototype.length=1; Event.prototype[0]=1; onhashchange=alert; onmessage=alert;
-
-
alert is passed the argument 1 when postMessage is called or the hash changes
-
I understand what this does: I was suggesting that instead of waiting for either, you can force onhashchange to happen.
-
ah I see yeah true and also an attacker could trigger this with iframes or postMessage too
End of conversation
New conversation -
-
-
the args comes from here: Error.prototype[0]=123
-
sorry I meant:-Event.prototype[0]=124
End of conversation
New conversation -
-
-
btw honoured that you follow me
I've respected your work for yearsThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.