Posts Tagged attack
v0.3 Release - Problems with my Patch for bug 459727
Posted by Sid in Mercurial Project, Open Source on December 2nd, 2008
Lately there has been some activity on bug 459727 concerning the patch I had submitted to implement an OnScroll feature for the pushlog. View comments 8 and 9 to see the problems that jorendorff as identified. So far there hasn’t been an official review but it is inevitable that I will have to make changes to the patch I had submitted.
In comments 10 and 12 I underlined what steps I will be taking to fix the problems that jorendorff has identified so far. They don’t seem to be major changes although I am worried about using JSON.parse(). I don’t know if that will work or not. I guess I will have to try it out and see what I can do.
Also I don’t really understand what is wrong with using `new Function(”return ” + entries.responseText) ()` as jorendorff mentioned in comment 9. In comment 11, Justin mentioned that it may cause vulnerabilities to XSS attacks but he couldn’t explain why that was. This has me interested and I would love it if someone could tell me why.
This is the biggest patch I submitted for my v0.2 so I’m expecting to go through several iterations before the patch is accepted. Look out for a new patch soon…