Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me:

& JavaScript includes
<BR SIZE="&{alert('XSS')}">

I tried out the following HTML:

        <br size="&{alert('1')}">

on Firefox 31.0 and it didn't seem to work (i.e. no alert box). Did I miss anything, or is this technique only applicable to older browsers?

share|improve this question
html5sec.org has some newer XSS methods. I checked the documentation for the <br /> tag and it doesn't mention any attributes. –  Vinayak Aug 8 at 7:00

1 Answer 1

up vote 13 down vote accepted

JavaScript, the Definitive Guide, 4th Edition - published in 2001 - mentions these in a bit more detail. The relevant section appears to be freely available. It's right at the bottom of that link. Here's the excerpt:

12.2.5. JavaScript in Nonstandard Contexts

Both Netscape and Microsoft have implemented proprietary extensions in their browsers, and you may occasionally see JavaScript code in a context other than those described here. For example, Internet Explorer allows you to define event handlers in a <script> tag that uses special for and event attributes. Netscape 4 allows you to use JavaScript as an alternative syntax for defining CSS style sheets within a <style> tag. Netscape 4 also extends the HTML entity syntax and allows JavaScript to appear within entities (but only within the values of HTML attributes). This can result in HTML that looks like this:

<table border="&{getBorderWidth( )};"> 

Finally, Netscape 4 also supports a form of conditional comment based on this JavaScript entity syntax. Note that Netscape 6 and the Mozilla browser on which it is based no longer support these nonstandard uses of JavaScript.

So it's an abuse of the typical HTML entity syntax - the kind where we use &amp; to produce an ampersand. Instead of writing amp, I write {alert('oh no')}.

However, the book mentions that Netscape 6 - released in 2000, around the time of IE6 - and the very early Mozilla browser were already taking action to eliminate this exploit. It's fairly unlikely it exists in recent browser versions.

If it ever affected Internet Explorer (which isn't mentioned as even permitting this in the first place), I have no information on at what version it ceased being a viable IE exploit.

share|improve this answer
Indeed this was only ever implemented on the legacy Netscape (≤4) family and not IE or any other browser. It is no longer of practical use as an evasion mechanism. –  bobince Aug 8 at 11:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.