Pushwoosh · Report #200419
Clickjacking
Validstatus
mediumseverity
7upvotes
2 Feb 2017disclosed
How it was found
Steps to reproduce:
create index.html file with following content:
<iframe sandbox="allow-scripts allow-forms" src="https://go.pushwoosh.com/register" width="1000" height="600"></iframe>Open index.html in browser
Actual result: Pushwoosh viewed in iframe. Expected result: do not allow clickjacking Root cause:
var isInIFrame = (function () {
try {
return window.self !== window.top;
} catch (e) {
return true;
}
})();