Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
3 Formatting.
source | link

Allowing ostensibly "self-XSS" attacks may have secondary ramifications.Allowing ostensibly "self-XSS" attacks may have secondary ramifications.

As an example, I recently saw an issue where a text field would, according the the bug report, remove all text after a Less-Than Sign. The browser was interpreting the Less-Than Sign as the start of an HTML tag.

Another issue may be if the userthat I've seen is using thethat such "self-XSS" fields do not allow any arbitrary valid input. For instance, consider a "notes" field, in which the user may wish to store notes. He may have a note like thissomething that they learned:

One can make bold text by surrounding it with these tags: <b>Hello, bold world!</b>

If your application allows "self-XSS" attacks, then the user will have difficulty adding such a note.

Allowing ostensibly "self-XSS" attacks may have secondary ramifications. I recently saw an issue where a text field would, according the the bug report, remove all text after a Less-Than Sign. The browser was interpreting the Less-Than Sign as the start of an HTML tag.

Another issue may be if the user is using the field to store notes. He may have a note like this:

One can make bold text by surrounding it with these tags: <b>Hello, bold world!</b>

If your application allows "self-XSS" attacks, then the user will have difficulty adding such a note.

Allowing ostensibly "self-XSS" attacks may have secondary ramifications.

As an example, I recently saw an issue where a text field would, according the the bug report, remove all text after a Less-Than Sign. The browser was interpreting the Less-Than Sign as the start of an HTML tag.

Another issue that I've seen is that such "self-XSS" fields do not allow any arbitrary valid input. For instance, consider a "notes" field, in which the user may wish to store something that they learned:

One can make bold text by surrounding it with these tags: <b>Hello, bold world!</b>

If your application allows "self-XSS" attacks, then the user will have difficulty adding such a note.

2 added 4 characters in body
source | link

Allowing ostensibly "self-XSS" attacks may have secondary ramifications. I recently saw an issue where a text field would, according the the bug report, remove all text after a Less-Than Signremove all text after a Less-Than Sign. The browser was interpreting the Less-Than Sign as the start of an HTML tag.

Another issue may be if the user is using the field to store notes. He may have a note like this:

One can make bold text by surrounding it with these tags: <b>Hello, bold world!</b>

If your application allows "self-XSS" attacks, then the user will have difficulty adding such a note.

Allowing ostensibly "self-XSS" attacks may have secondary ramifications. I recently saw an issue where a text field would, according the the bug report, remove all text after a Less-Than Sign. The browser was interpreting the Less-Than Sign as the start of an HTML tag.

Another issue may be if the user is using the field to store notes. He may have a note like this:

One can make bold text by surrounding it with these tags: <b>Hello, bold world!</b>

If your application allows "self-XSS" attacks, then the user will have difficulty adding such a note.

Allowing ostensibly "self-XSS" attacks may have secondary ramifications. I recently saw an issue where a text field would, according the the bug report, remove all text after a Less-Than Sign. The browser was interpreting the Less-Than Sign as the start of an HTML tag.

Another issue may be if the user is using the field to store notes. He may have a note like this:

One can make bold text by surrounding it with these tags: <b>Hello, bold world!</b>

If your application allows "self-XSS" attacks, then the user will have difficulty adding such a note.

1
source | link

Allowing ostensibly "self-XSS" attacks may have secondary ramifications. I recently saw an issue where a text field would, according the the bug report, remove all text after a Less-Than Sign. The browser was interpreting the Less-Than Sign as the start of an HTML tag.

Another issue may be if the user is using the field to store notes. He may have a note like this:

One can make bold text by surrounding it with these tags: <b>Hello, bold world!</b>

If your application allows "self-XSS" attacks, then the user will have difficulty adding such a note.