Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

Brave crashes if alert is called without a message #4798

Closed
bridiver opened this issue Oct 14, 2016 · 4 comments
Closed

Brave crashes if alert is called without a message #4798

bridiver opened this issue Oct 14, 2016 · 4 comments

Comments

@bridiver
Copy link
Collaborator

Did you search for similar issues before submitting this one?
Yes

Describe the issue you encountered:
from https://hackerone.com/reports/175850
<script>alert()</script> will crash brave on toString

Expected behavior:

  • Platform (Win7, 8, 10? macOS? Linux distro?):
    All
  • Brave Version:
    master
@luixxiul
Copy link
Contributor

Any page to test this?

@alexwykoff
Copy link
Contributor

@luixxiul It's pretty easy to write a local file and open it. The behavior is the the same.

@willy-b
Copy link
Contributor

willy-b commented Oct 18, 2016

You can also use paste a data URL right into the URL bar: data:text/html,<script>alert()</script>

@willy-b
Copy link
Contributor

willy-b commented Oct 18, 2016

BTW, this is still an issue if you pass a title which is a number, e.g.:
data:text/html,<script>alert(1, 1)</script> will crash Brave.

EDIT: rolled this into PR #4891

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

5 participants