Windows 10 - Spartans forgotten VBScript support
Taken from:
[...] Gone were document modes. Removed was the subsystem responsible for emulating IE8 layout quirks. VBScript eliminated.
I really liked to read that Spartan finally dropped VBScript support completely. But of course I was curious if this is really the case. Maybe they have forgotten a feature, in a different context than html, which supports VBScript too.
Because you are reading this blog entry right now it is obvious they did ;)
urn:schemas-microsoft-com:xslt
I was playing around with XML and XSLT and the possible attack vectors when I came across this interesting msdn page: msxsl:script.
Internet Explorer and Spartan support a tag in XSLT, which is called msxsl:script. It can be used to call JScript or VBscript in XSLT and use the return value.
You don't have access to the DOM etc, but native VBScript functions still work in Spartan.
Note: IE 11 in Edge mode will execute the VBScript too.
Poc:
xml_stylesheet.xml
<?xml version="1.0" encoding="UTF-8"?> <?xml-stylesheet href="xml_stylesheet.xsl" type="text/xsl"?> <catalog> <cd> <title>Empire Burlesque</title> <artist>Bob Dylan</artist> </cd> </catalog>
xml_stylesheet.xsl
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
xmlns:user="http://mycompany.com/mynamespace">
<msxsl:script language="VBScript" implements-prefix="user">
Function xml()
xml = Timer
End Function
</msxsl:script>
<xsl:template match="/">
<html>
<body>
<h2><xsl:value-of select="user:xml()"/>My CD Collection</h2>
<table border="1">
<tr bgcolor="#9acd32">
<th style="text-align:left">Title</th>
<th style="text-align:left">Artist</th>
</tr>
<xsl:for-each select="catalog/cd">
<tr>
<td><xsl:value-of select="title"/></td>
<td><xsl:value-of select="artist"/></td>
</tr>
</xsl:for-each>
</table>
</body>
</html>
</xsl:template>
</xsl:stylesheet>
Result
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:user="http://mycompany.com/mynamespace"> <body> <h2>55791.859375My CD Collection</h2> <table border="1"> <tr bgcolor="#9acd32"> <th style="text-align:left">Title</th> <th style="text-align:left">Artist</th> </tr> <tr> <td>Empire Burlesque</td> <td>Bob Dylan</td> </tr> </table> </body> </html>
