Does a mobile application written with Nativescript, which utilizes a cross-platform Javascript runtime, have the same XSS vulnerability as a website?

  • XSS implies something coming from another site; if the html/js is all local, that doesn't apply.
    – dandavis
    Aug 18, 2016 at 2:19
  • Actually I am mostly concerned over an unescaped user input to break the context of the xml during binding and thus inject some code like "tap=...". Is that possible with Nativescript as it is with the browser? What kind of measures keep it from happening? There is also the eval() possibility too.
    – John L.
    Aug 18, 2016 at 15:32


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.