Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28355

Re: Java vs JavaScript

Show all headers | View raw

On Fri, 02 May 2014 11:10:07 +0200, Silvio <silvio@internet.com>
wrote:

>On 05/01/2014 11:10 PM, Gene Wirchenko wrote:
>> On Thu, 01 May 2014 10:26:25 +0200, Silvio <silvio@internet.com>
>> wrote:
>>
>> [snip]
>>
>>> That is because JavaScript IS part of the HTML page and it can not
>>> contain a security hole by definition. Only the browser displaying the
>>> page can.
>>
>>       Oh, nonsense.  Put an onclick= in an <a> tag to go to a different
>> URL than specified in the href=, and you have a security issue due to
>> JavaScript.
>>
>> [snip]

>Now that is nonsense. Why is it a security issue if that is what the 
>HTML page says it should do? It is something that can be discovered from 
>the page itself and anything the JS instructs the browser to do it can 
>decide to refuse.

     Well, if you hover on the link, Firefox, at least, will display
the link as being according to the href= phrase, but the actual
destination will be according to the onclick= phrase.

     Why should someone have to examine the page code to see what will
be done?  Does that not suggest to you that someone might be trying to
pull a fast one?  That situation is a security issue.

>On the other hand IE allows the loading of ActiveX controls from 
>JavaScript and call native code on them which runs completely outside 
>the browsers control. Depending on the users security settings and how 
>correct these have been implemented in IE this is certainly an area of 
>concern. But that is only because IE deliberately implements this 
>functionality. That makes IE dangerous, not JS. BTW: ActiveX object can 
>also be loaded with HTML only.

     This is also dangerous.

     There is more than one mine in this security minefield.

Sincerely,

Gene Wirchenko

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Java vs JavaScript Roedy Green <see_website@mindprod.com.invalid> - 2014-04-23 08:39 -0700
  Re: Java vs JavaScript markspace <markspace@nospam.nospam> - 2014-04-23 09:10 -0700
  Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-04-23 15:48 -0500
  Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-04-23 23:36 +0200
    Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-27 12:20 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:05 +0800
      Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-04-27 22:55 +0200
      Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-01 08:52 +0100
        Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-01 10:26 +0200
          Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-01 14:10 -0700
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:10 +0200
              Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-02 10:20 -0700
                Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-05-02 20:16 +0200
                Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-04 10:38 +0100
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-05 00:16 -0500
                Re: Java vs JavaScript Tim Slattery <tim@risingdove.com> - 2014-05-06 13:06 -0400
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-06 12:40 -0500
            Re: Java vs JavaScript Simon Lewis <simonlewis2001@gmail.com> - 2014-05-02 12:53 +0200
          Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-05-01 21:16 -0400
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:17 +0200
  Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-23 22:22 -0400
    Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:20 +0800
      Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-29 21:07 -0400
  Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:15 +0800
    Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 09:00 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:15 +0800
        Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 16:59 +0100
  Re: Java vs JavaScript Ray Osborne <rko153@gmail.com> - 2014-05-22 05:08 -0700

csiph-web