Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is certainly a bad idea. But does it allow XSS on a system without vulnerable protocol handlers?

All browsers I tested (Chrome 22, FF 18, IE 9, Opera 12) do not show anything when pointed to javascript://alert('XSS'), but that could certainly just be because I'm not creative enough. Similarily, javascript://alert('XSS') (which would make the first double slashes a comment, and the alert a new line) doesn't work either.

share|improve this question
1  
This isn't really an on-topic question - it falls well within the normal handling of URL's. – Rory Alsop♦ Feb 5 at 18:09
2  
@RoryAlsop Sorry, I'm new to sec.sx. Could you elaborate why this question is off-topic? (and why you didn't close it as such?) Isn't this related to web app hardening, the first item in the list of topics? And how come dozens of quite similar questions about XSS details are still open? – phihag Feb 5 at 18:12
1  
@phihag - Your question is whether a commented out part of a JavaScript code can be executed by browsers, and then answer your very own question within the same minute that they don't if it's contained in the same line that was commented out. Of course, the JavaScript command that was moved to a new line that isn't commented out will be processed. It doesn't matter if the new line identifier was written using escape characters, which is rather obvious, isn't it? Being part of a HTML document, it is parsed by the browser, escape characters including. What's strange here? – TildalWave Feb 5 at 18:24
1  
@TidalWave Note that I answered within the same second, and I see nothing wrong with that. I should've asked you guys earlier; for me, it wasn't obvious at all. I just inserted a newline (or ) and didn't realize that although that does not work, simply urlencoding does. – phihag Feb 5 at 18:37
2  
Reopened - thanks for the discussion on the DMZ to help clarify. – Rory Alsop♦ Feb 5 at 18:42
show 4 more comments

1 Answer

up vote 2 down vote accepted

The // makes the line a comment, but the newline is (as whitespace) not allowed in a URL, htmlencoded or not. Simply urlencode it, like this:

<a href="javascript://%0Aalert('XSS');">XSS</a>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.