4

This is my source code:

<!DOCTYPE html>
<html>
  <head>
    <title>XSS</title>
    <script src="http://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.2.1.min.js"></script>
    <script>
    var output = "";
    <?php
    if (isset($_GET['q'])) {
      printf('output = "%s";', htmlspecialchars($_GET['q'],ENT_QUOTES, 'UTF-8'));
    }
    ?>

    $(function()  {
      $("#output").html(output);
    });
    </script>
  </head>
  <body>
    <p id="output"></p>
  </body>
</html>

When I send q=\x3cscript\x3ealert(1)\x3c/script\x3e to my script, the alert is fired. How can I prevent this?

Improve this question
1

1 Answer 1

Reset to default
8

Escaping is context sensitive. You are escaping for HTML, but are using the variable in Javascript. Instead, correctly encode for JavaScript using json_encode:

printf('output = %s;', json_encode($_GET['q']));

Also, you are using the html function even though you don't seem to want HTML at all. What you probably want is the text function:

$("#output").text(output);
Improve this answer
2
  • Just a thought: would json_encode catch </script><script>alert(1) ?
    – paj28
    Commented Mar 22, 2017 at 9:54
  • 1
    @paj28 Yes, it encodes the slash as \/.
    – Sjoerd
    Commented Mar 22, 2017 at 10:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .