元标记中的javascript在Firefox和Internet Explorer上不起作用

Question

I noticed this:

<meta HTTP-EQUIV="REFRESH" CONTENT="0;URL=javascript:alert(2)">

Only works on chrome, so my question is, how can I execute JavaScript within a meta tag that will work on chrome, firefox and internet explorer? As far as my tests have gone, that only works in chrome and not on internet explorer and firefox.

Answer 1

javascript: URIs where disabled in Firefox via MSFA 2009-22 / CVE-2009-1312 . I guess Internet Explorer disables such URIs for the same reason.

Hence you cannot use javascript: URIs for meta-refresh. Of course you're still free to do something like:

<script>
  setTimeout(function() { alert(2); }, 0);
  // or just
  alert(2);
</script>