4

I came across a scenario, where userinput is reflecting in anchor tag href value. So if i put test there it reflects as <a href="/test"> Due to this default slash added in the code, javascript:alert(1) will not execute since, it will be treated as URL. Also " is not allowed and gives 400. In this case, is there a possibility to bypass the check, or any way to XSS.

Improve this question

1 Answer 1

Reset to default
1

For the sake of keeping things simple, let's assume that you cannot break out of the href attribute and that your input is always prefixed by a /. Unfortunately, there is not trivial bypass for this scenario since as you pointed out, the / renders your payload harmless.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .