Re: Re[4]: [Full-disclosure] Update: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari, Opera, Chrome, Seamonkey, iPhone, iPod, Wii, PS3....

[Michal Zalewski <lcamtuf@xxxxxxxxxxx>]

> The W3C DOM specifies the select.length attribute to be *read only*.

Does not seem to be the case in HTML5 at least?

http://dev.w3.org/html5/spec/Overview.html#the-select-element

In fact, it has the behavior for writes defined:

"On setting, it must act like the attribute of the same name on the
options collection."

It may or may not have any practical uses (dynamic resizing of SELECTs
without having to delete individual options).

/mz