miscoded

Edit: the post title was meant to end with a smiley but the server turned it into HTML IMG markup.. Changing the title somewhat to make it sound less dramatic since I didn't get the smiley effect.

Quick quirk of the day: some methods on the window object can be called even from another domain. In Firefox these are window.close(), window.focus(), window.blur(), document.open() and (oddly enough) window.history.go().

It turns out that Firefox allows calling them even if they have been redefined in the page! So if you say

function close(){ alert('look, ma, x-domain!'); }

another site can call your window's close() method and your custom function will run. It can even return things the foreign script can use.

function close(){ return document.body.innerHTML; /* I'm so proud of my markup, I'll show anybody */ }

Quirky for sure. Insecure? Maybe it has some extremely limited XSS exploit potential. It would become an issue if a script author writes a function that returns something secret and names it close, blur or focus. But real-life severity depends on how likely that would be, and my guess is that even if scripters might use such function names they would be very unlikely to returning secrets from them. So IMO it's not a big issue. Mozilla hackers may want to fix it someday, meanwhile it might even be useful if you want to make your site slightly more accessible than current cross-domain limitations allow.