FBJS Beta Security Hole #3

Today’s exploit uses the same constructor-climbing technique as yesterday’s exploit, but explores a different avenue of attack: direct DOM access. FBJS does an excellent job of properly scoping objects so that the only access points to the DOM are the ones they provide you. For example, let’s say I grab an FBJS-wrapped DOM element:

  var div = document.getElementById("myElement");

This gets re...