When reviewing some javascript security ideas, I came across the document.URL property. Turns out that my normal way of retrieving the location (document.location.href) is both a getter and a setter. The document.URL is just a getter.
Check it out with this code:
1 2 3 4 | alert(document.URL); alert(document.location.href); document.URL = 'http://google.com'; document.location.href = 'http://yahoo.com'; |
The results are simple: you will get the current location twice – and then an error. If you comment out the document.URL line, it will redirect to yahoo.
but in ie,the document.URL still take effect.switch the last two statement,you’ll find out that it will redirect to google.com.