web-platform-tests / web-platform-tests/wpt
Add script-src test cases for ES6 Reflect API (unsafe-eval)
Open
@hillbrad is already working on this.
Since Sep 22, 2015.
content-security-policy
wg-webappsec
- Dominant language
- HTML
- Stars
- 6.2k
- Forks
- 3.9k
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 586
Description
FF 42 supports the ES6 Reflect API. New DOMXSS sink:
Reflect.set(location, 'href', 'javascript:alert(1)')
https://t.co/lHFWLJzRC6
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.