When reviewing some javascript security ideas, I came across the document.URL property. Turns out that my normal way of retrieving the location (document.location.href) is both a getter and a setter. The document.URL is just a getter.
Check it out with this code:
1 2 3 4 | alert(document.URL); alert(document.location.href); document.URL = 'http://google.com'; document.location.href = 'http://yahoo.com'; |
The results are simple: you will get the current location twice – and then an error. If you comment out the document.URL line, it will redirect to yahoo.
Tags: javascript
but in ie,the document.URL still take effect.switch the last two statement,you’ll find out that it will redirect to google.com.