Burp has identified a potential DOM XSS vulnerability:
The application may be vulnerable to DOM-based cross-site scripting. Data is read from window.location.href and passed to the 'setAttribute()' function of a DOM element
In this example, the vulnerable code is like (I can't include the actual original for confidentiality):
var thing = windows.location.href; ... element.setAttribute("fill", thing);
Doing some quick tests (in Chrome), this is vulnerable:
But this is not:
document.getElementById("bob").setAttribute("fill", "" onclick="alert(1)");
Given all that, I feel Burp has reported a false positive. But I worry I may have missed something, so further input would be appreciated.
I am only interested if this is exploitable in recent browsers. I'm not interested in "it's not best practice" or "exploitable in IE 4 on a Mac".