bevry-archive / jquery-sparkle Goto Github PK

Make some parts of code break in file jquery.events.js

Hello, I have an application that uses this functionality. On desktops it works on all browers, but on mobile it only works on chrome mobile. I would like it to work on firefox and native android browser too. Any way of doing that?

https://github.com/balupton/jquery-sparkle/blob/master/scripts/resources/core.string.js

In the function there, on line 203, you're doing an eval on whatever is in that link. I fear for people who might be using this on their websites, as suggested here: https://github.com/balupton/jquery-history. All someone has to do is URLEncode malicious javascript, shorten the link (or hell, perhaps not even that), and send it to unsuspecting victims.

To take the example in your jquery-history readme, change the URL to this and see the arbitrary javascript executed with the example:

http://localhost/page/#subpage?a=true&b=alert(%22holy+crap%22)%3B.

I'm not sure what the motivation for that eval is, but it is very, very, bad.