Wed, 31 Dec 2014 06:09:35 +0100
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
michael@0 | 1 | <html xmlns="http://www.w3.org/1999/xhtml"> |
michael@0 | 2 | <head> |
michael@0 | 3 | <script> |
michael@0 | 4 | var x=document.createElementNS('http://www.w3.org/1999/xhtml','style'); |
michael@0 | 5 | document.documentElement.appendChild(x); |
michael@0 | 6 | function doe(){ |
michael@0 | 7 | var y=document.getElementsByTagName('style')[0]; |
michael@0 | 8 | } |
michael@0 | 9 | setTimeout(doe,500); |
michael@0 | 10 | </script> |
michael@0 | 11 | |
michael@0 | 12 | <style> |
michael@0 | 13 | style {-moz-binding:url(#randomxbl);} |
michael@0 | 14 | </style> |
michael@0 | 15 | |
michael@0 | 16 | <bindings xmlns="http://www.mozilla.org/xbl"> |
michael@0 | 17 | <binding id="randomxbl"> |
michael@0 | 18 | <implementation> |
michael@0 | 19 | <constructor> |
michael@0 | 20 | var x= parent.document.getElementsByTagName('iframe')[0]; |
michael@0 | 21 | x.parentNode.removeChild(x); |
michael@0 | 22 | </constructor> |
michael@0 | 23 | </implementation> |
michael@0 | 24 | </binding> |
michael@0 | 25 | </bindings> |
michael@0 | 26 | </head> |
michael@0 | 27 | <body> |
michael@0 | 28 | </body> |
michael@0 | 29 | </html> |