Return to Answer

Generally speaking, no, this is not a Cross Site Scripting (XSS) issue.

You can have two problems:

1. If the attacker control the first bytes of the output, the Rosetta Flash attack can be used to trigger a Cross Site Scripting (XSS), regardless of the content-type of the page. But if you start the output with /*, like you said you do, I can not see any risk;
2. Outdated browsers (e.g.: IE 7) have content-sniffing issues, so even you setting the content-type of your page to text/javascript, an attacker could trick the browser to execute your page as HTML. Nowadays, this type of attack is very rare. Use the following header to become safer.

X-Content-Type-Options: nosniff

Important update:

I am supposing you are serving the page with Content-Type: text/javascript.

If you are serving the page with Content-Type: text/html and you are not encoding < and >, you are completely vulnerable to XSS.

Example:

http://example.com/CombinedScripts?file=<img src=x onerror=alert(9)>

Generally speaking, no, this is not a Cross Site Scripting (XSS) issue.

You can have three problems:

1. If the attacker control the first bytes of the output, the Rosetta Flash attack can be used to trigger a Cross Site Scripting (XSS), regardless of the content-type of the page. But if you start the output with /*, like you said you do, I can not see any risk;
2. Outdated browsers (e.g.: IE 7) have content-sniffing issues, so even you setting the content-type of your page to text/javascript, an attacker could trick the browser to execute your page as HTML. Nowadays, this type of attack is very rare. Use the following header to become safer;

X-Content-Type-Options: nosniff

3. If you have sensitive informations in your javascript based on an authenticated session, you have other vulnerability, called Cross Site Script Inclusion (XSSI).

Important update:

I am supposing you are serving the page with Content-Type: text/javascript.

If you are serving the page with Content-Type: text/html and you are not encoding < and >, you are completely vulnerable to XSS.

Example:

http://example.com/CombinedScripts?file=<img src=x onerror=alert(9)>

Generally speaking, no, this is not a Cross Site Scripting (XSS) issue.

You can have two problems:

1. If the attacker control the first bytes of the output, the Rosetta Flash attack can be used to trigger a Cross Site Scripting (XSS), regardless of the content-type of the page. But if you start the output with /*, like you said you do, I can not see any risk;
2. Outdated browsers (e.g.: IE 7) have content-sniffing issues, so even you setting the content-type of your page to text/javascript, an attacker could trick the browser to execute your page as HTML. Nowadays, this type of attack is very rare. Use the following header to become safer.

X-Content-Type-Options: nosniff

Important update:

I am supposing you are serving the page with Content-Type: text/javascript.

If you are serving the page with Content-Type: text/html and you are not encoding < and >, you are completely vulnerable to XSS.

Generally speaking, no, this is not a Cross Site Scripting (XSS) issue.

You can have two problems:

1. If the attacker control the first bytes of the output, the Rosetta Flash attack can be used to trigger a Cross Site Scripting (XSS), regardless of the content-type of the page. But if you start the output with /*, like you said you do, I can not see any risk;
2. Outdated browsers (e.g.: IE 7) have content-sniffing issues, so even you setting the content-type of your page to text/javascript, an attacker could trick the browser to execute your page as HTML. Nowadays, this type of attack is very rare. Use the following header to become safer.

X-Content-Type-Options: nosniff

Important update:

I am supposing you are serving the page with Content-Type: text/javascript.

If you are serving the page with Content-Type: text/html and you are not encoding < and >, you are completely vulnerable to XSS.

Example:

http://example.com/CombinedScripts?file=<img src=x onerror=alert(9)>

Generally speaking, no, this is not a Cross Site Scripting (XSS) issue.

You can have two problems:

1. If the attacker control the first bytes of the output, the Rosetta Flash attack can be used to trigger a Cross Site Scripting (XSS). But if you start the output with /*, like you said you do, I can not see any risk;
2. Outdated browsers (e.g.: IE 7) have content-sniffing issues, so even you setting the content-type of your page to text/javascript, an attacker could trick the browser to execute your page as HTML. Nowadays, this type of attack is very rare. Use the following header to become safer.

X-Content-Type-Options: nosniff

Edit:

I am supposing you are serving the page with Content-Type: text/javascript.

If you are serving the page with Content-Type: text/html and you don't encode < and >, you are vulnerable to XSS.

Generally speaking, no, this is not a Cross Site Scripting (XSS) issue.

You can have two problems:

1. If the attacker control the first bytes of the output, the Rosetta Flash attack can be used to trigger a Cross Site Scripting (XSS), regardless of the content-type of the page. But if you start the output with /*, like you said you do, I can not see any risk;
2. Outdated browsers (e.g.: IE 7) have content-sniffing issues, so even you setting the content-type of your page to text/javascript, an attacker could trick the browser to execute your page as HTML. Nowadays, this type of attack is very rare. Use the following header to become safer.

X-Content-Type-Options: nosniff

Important update:

I am supposing you are serving the page with Content-Type: text/javascript.

If you are serving the page with Content-Type: text/html and you are not encoding < and >, you are completely vulnerable to XSS.