Does anyone have a (non-malicious) example of this sort of "attack"? I don't quite get it; some people are mentioning Javascript, but the description sounds more like a phishing, e.g. `data:text/html;base64,MyBank.com/account/xxxxx`
Presumably such leading junk is hidden in the rendered page, making the user think they're on MyBank.com?
>Presumably such leading junk is hidden in the rendered page, making the user think they're on MyBank.com?
it's even simpler than that, they add a bunch of spaces after the "fake" url to pad out the actual payload so it doesn't show in the urlbar. any issues with the page content can be fixed with document.write or whatever.
I know of a website that decrypts all its content clientside and uses this (i think) as a mechanism for a user to download his own attachments.
The Idea is that the whole website could be a static file somewhere and the webserver is only a key value store that has no idea what it is saving. Doesn't work that way currently because file:/// doesn't allow ajax calls to somewhere else but that's a solveable problem.
Generally, every download that gets generated clientside by the JS is hit by this
Presumably such leading junk is hidden in the rendered page, making the user think they're on MyBank.com?