Loading script content from data URL

Question

I'm just testing whether it is possible to load a script via data url. To my surprise in my actual Chromium it works.

I load the following document:

<html>
    <head>
        <script type="text/javascript">
            var head = document.getElementsByTagName('head')[0];
            var script = document.createElement('script');
            script.type = 'text/javascript';
            script.src = 'data:text/javascript,alert("hello!");';
            head.appendChild(script);
            head.removeChild(script);
        </script>
    </head>
</html>

... and a box telling "hello!" pops up.

Isn't this as bad as eval()? This makes it possible to compile arbitrary contents (containing any POSTed content or GET parameters) and to "inject" it into the running code!

Can someone please tell me whether this is an intended behaviour common to actual browsers?

Related: stackoverflow.com/questions/9129666/…

Michał Perłakowski
– Michał Perłakowski

2016-01-17 23:58:06 +00:00
Commented Jan 17, 2016 at 23:58 — Michał Perłakowski
– Michał Perłakowski, Commented Jan 17, 2016 at 23:58

Community · Accepted Answer · 2017-05-23 10:28:35Z

1

It doesn't really differ from eval(), because it has almost the same behavior. However, in some cases eval() is not evil.

edited May 23, 2017 at 10:28

CommunityBot

11 silver badge

answered Jan 17, 2016 at 23:57

Michał Perłakowski

93.3k30 gold badges165 silver badges189 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Loading script content from data URL

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related