The link tooltip and the statusbar can be misleading

2006-02-17T00:00:00
ID OPERA:819
Type opera
Reporter Opera
Modified 2006-02-17T00:00:00

Description

It is possible to make a form input that looks like an image link.If the form input has a "title" attribute, the status bar will showthe "title". A "title" which looks like a URL can mislead the user,since the title can say http://nice.familiar.com/, while the formaction can be something else.Opera's tooltip says "Title:" before the title text, making a spoofURL less convincing. A user who has enabled the status bar anddisabled tooltips can be affected by this. Neither of these settingsare Opera's defaults.This exploit is mostly of interest to users who disable JavaScript.If JavaScript is enabled, any link target or form action can beoverridden by the script. The tooltip and the statusbar can onlybe trusted to show the true location if JavaScript is disabled.