Frame Injection Vulnerability won't affect OW?

[Yosuke Arai]

Thanks, It's a relief to hear that.

Yosuke Arai

On Fri, 2 Jul 2004 07:21:47 -0700, Greg Titus wrote:
> 
> Yes, OmniWeb is safe from this vulnerability. This has been true of 
> every release since 4.5 on (and may also have been true earlier - 
> that's just as far back as I've checked the code).
> 
> When a link has a target name in OmniWeb, it can only target frames 
> that are in the same window, or the very topmost frame (i.e. the full 
> window content) in other windows. We don't even look at the names of 
> subframes in different windows so it is impossible for the scenario 
> secunia describes here to happen in OmniWeb.
> 
> If the top level frame in another window has a name for some reason 
> (which is usually rare except for smaller 'subwindows' created by 
> javascript on various sites) then a malicious site could replace the 
> content in that other window, but it wouldn't be a security issue 
> since there would be no way to hide the origin of the new content the 
> way there is with replacing just a subframe.
> 
> 	- Greg
>