Other nomination

Bonus Safari XXE (only affecting Safari 4 Beta)

Chris Evans

A WebKit regression in the Safari 4 Beta reopened XML external entity resolution, letting a crafted XML document read and exfiltrate local files. The regression was noticed through a collision with the Chrome sandbox and fixed before the Safari 4 final release, so no production browser shipped it.

Record

Researcher

Chris Evans

In the archive

• Nominated for the 2009 Top 10 Web Hacking Techniques

Tags

• xxe
• info-leak
• sop-bypass
• same-origin-policy
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Chris Evans, first published at the original source. Preserved copies are kept so the citation survives its host.