Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Backstory: Stack Exchange's markdown parser allows a couple of HTML tags (a,b,i,img) through, with some restrictions on the attributes to prevent XSS. We're thinking of requesting the <cite> tag to be allowed so people can include citation metadata in the script.

So, the question is, does allowing the <cite> tag to be used in user-submitted content expose any XSS (or similar) vulnerabilities? As far as I can tell, the tag is harmless as it only contains metadata (which may be rendered by extensions or the like).

share|improve this question
    
No. Allowing non-executable tags (e.g. cite) would not create XSS. –  Albert Mar 14 at 15:12

2 Answers 2

up vote 3 down vote accepted

Looking at the definition for the cite tag it doesn't look like in and of itself it's likely to introduce XSS issues as in most uses it's a bare tag without JavaScript style parameters.

The only potenial issue I could see is if it interacts badly with the code that is being used to filter content in a tags as a tags can be nested inside cite tags, but that's mainly just a filter implementation issue rather than a fundamental problem.

share|improve this answer

While it is true that the bare tag of cite itself will not cause any XSS issues, however, with the addition of javascript event handler, XSS would be possible.

However, StackExchange would most probably block all of the javascript event handlers(or whitelist the number of allowed attributes) so I believe this is not an issue.

Vector: Click Me! Sample: http://jsfiddle.net/m2zRD/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.