CODEWITHSUNDEEP
javascriptxssexploit
user239558
user239558

Reputation: 7286

Determine if window was opened using javascript

There is now a UXSS metasploit module for stock Android browsers that it would be great to have a defence against.

One such defence is to use X-Frame-Options and additionally be able to know that there is no javascript reference to the window. My question is whether it is possible to determine that no other window holds a reference to the current window object because it was not opened using javascript.

This answer is not relevant since in this case no co-operation with the opener exists.

Upvotes: 0

Views: 77

Answers (1)

symcbean
symcbean

Reputation: 48357

I don't think that this is possible.

However with Firefox and Chrome, calling window.close() only has an effect on windows which were opened with Javascript. Older versions of MSIE (5,6) close the window regardless, I don't know about more recent versions.

Upvotes: 1

Related Questions