Re: [Full-Disclosure] RE: FWD: Internet Explorer URL parsing vulnerability

[Michal Zalewski <lcamtuf@ghettot.org>]

On Tue, 9 Dec 2003, S G Masood wrote:

> http://www.microsoft.com%01@www.linux.org
>  wont work until you
> unescape('http://www.microsoft.com%01@www.linux.org');

Out of sheer curiosity (no MSIE at hand)... would it work with:

  <a href="http://A\x01@B";>

...meaning, put literal ASCII character #001 in a href tag, as opposed to
using JavaScript or alikes?

-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-12-09 22:38 --

   http://lcamtuf.coredump.cx/photo/current/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html