Bugtraq: Re: XSS on Yahoo Mail

["Jim Ley" <jim () jibbering com>]

"Will Wesley" <willwesleyccna () yahoo de> wrote in message 
news:20051124025004.32883.qmail () web26902 mail ukl yahoo com   

> This is not exactly a problem with Yahoo!, but rather
> a problem with the way browsers tend to render HTML
> when forced to deal with broken tags.
So it's a problem with Yahoo, as they allow the email, to write to places on 
the screen that is not part of the email.  I agree this is certainly down to 
the liberalness of the browsers parser, but that doesn't mean yahoo can 
ignore it, it's just a demonstration of how difficult a job it is for people 
who want to accept arbitrary HTML to be secure for their user

Of course there is a pretty simple solution, which is to just use an IFRAME, 
then there's no way the email to escape into the surrounding chrome.

Jim.