Timeline for XSS attack vsibible in html but no running
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 30, 2018 at 18:49 | comment | added | dandavis | @Ajedi32: no, those setters automatically escape the text for you, and that's what keeps it from being interpreted. you can prove this by setting the textContent and getting the innerHTML... | |
| Aug 30, 2018 at 14:42 | comment | added | Ajedi32 |
Note that some JS features like textContent and createTextNode allow adding unescaped text to the page in a way that prevents it from being interpreted as HTML. That's likely what's happening here.
|
|
| Aug 30, 2018 at 14:12 | history | answered | Sjoerd | CC BY-SA 4.0 |