Interessant. Urs schreibt korrekt «...sicherheitslücken mit JavaSripten...». Die eigenlichen Sicherheitslücken werden durch die betreffenden JavaScripts getriggert und nicht verursacht. Die Ganze Problematik ist ja eng mit URLs verbunden. Interessant hierzu sind die betreffenden Sicherheitshinweise in RFC 1738 «Uniform Resource Locators (URL)»
http://www.ietf.org/...1738.txt?number=1738 <QUOTE>
6. Security Considerations
The URL scheme does not in itself pose a security threat. Users
should beware that there is no general guarantee that a URL which at
one time points to a given object continues to do so, and does not
even at some later time point to a different object due to the
movement of objects on servers.
A URL-related security threat is that it is sometimes possible to
construct a URL such that an attempt to perform a harmless idempotent
operation such as the retrieval of the object will in fact cause a
possibly damaging remote operation to occur. The unsafe URL is
typically constructed by specifying a port number other than that
reserved for the network protocol in question. The client
unwittingly contacts a server which is in fact running a different
protocol. The content of the URL contains instructions which when
interpreted according to this other protocol cause an unexpected
operation. An example has been the use of gopher URLs to cause a rude
message to be sent via a SMTP server. Caution should be used when
using any URL which specifies a port number other than the default
for the protocol, especially when it is a number within the reserved
space.
Care should be taken when URLs contain embedded encoded delimiters
for a given protocol (for example, CR and LF characters for telnet
protocols) that these are not unencoded before transmission. This
would violate the protocol but could be used to simulate an extra
operation or parameter, again causing an unexpected and possible
harmful remote operation to be performed.
The use of URLs containing passwords that should be secret is clearly
unwise.
</QUOTE>