Brave Software · Report #215044
[iOS] URL can be replaceState by blob URL in iOS Brave
Validstatus
lowseverity
6upvotes
10 Aug 2017disclosed
How it was found
Summary:
URL can be replace by blob URL using function history.replaceState()
Products affected:
iOS brave version 1.3.1(17.02.14.11)
Steps To Reproduce:
-
Add a html named "blob.html" which link is "http://192.168.1.111/blob.html"
-
And its source is:
<script>
history.replaceState('','','blob:http://192.168.1.111/xxxx')
</script>
- then visit this page,you will find that URL has been replace by blob URL successfully!