What are the examples of XSS (or other attacks) using "forward slash" only? [duplicate]

Question

In OWASP XSS cheat sheet it is written

In addition to the 5 characters significant in XML (&, <, >, ", '), the forward slash is included as it helps to end an HTML entity.

So the recommended escapings are

 & --> &
 < --> &lt;
 > --> &gt;
 " --> &quot;
 ' --> &#x27;
 / --> &#x2F;

What if I skipped escapings of /? What are the examples of attacker payload using just / that can trigger XSS or other attack (assuming & < > " ' are all escaped)?

In my particular scenario, we have an XSS filter in the Java servlet, which sanitizes the payload of all incoming HTTP requests (it can be argued if it's a good solution or not), and it replaces / --> / which is a pain because / is a valid character in street names etc. One option would be to redecode &#x2F --> / but I'm wondering if there are any merits of keeping / escaped?

Edit: why I don't want to have / to be escaped:

The / is escaped before data comes to the Java code which saves stuff to DB. So, Java asks the DB to save escaped data, then when the frontend app asks Java to give us back the data, it gives back a JSON like

{something: "a &#x2F b"}

instead of

{something: "a / b"}

(well, to fix that, we could just have Java code iterate over the structure it returns and unescape it, but maybe there's no point in escaping it in the first place?)

Note that the same backend is consumed by many frontends, some of them non-HTML. It doesn't make any sense to serve escaped HTML data as a JSON, particularly for non-HTML consumers (correct me if I'm wrong).

Moreover, in HTML app, we use Angular code like this

<p>Hello {{name}}!</p>

which, when given a &#x2F b, will print that string literally to the user (i.e. Angular does another round of escaping by replacing & to & etc.).

To have HTML entities interpreted, I'd have to use ng-bind-html (see this plunk)

<p>Hello <span ng-bind-html="name"></span>!</p>

but I expect my JSON contents to be regular text, so I don't want to use ng-bind-html as it lowers the security.

Answer 1

Injecting a forward slash is not a common attack vector for XSS.

The required escaping depends on the context where you're printing the output. A forward slash is used to close a tag and there is no other HTML context where it's inherently dangerous. (In Javascript this would of course be a very different story. Also, slashes are relevant in other attacks, such as directory traversals.)

What are the examples of attacker payload using just / that can trigger XSS?

Such scenarios are rather artificial. For example, between a <title> tag all other tags are ineffective until you close the tag again. This would not trigger:

<title><img src=foo.jpg onerror=alert('no bounty for you')></title>

So if you encounter a scenario like...

<title>[userinput]</title>

...you would need a slash to be able to close the title tag yourself to achieve XSS.

The reason why the OWASP cheat sheet recommends a few more measures is to cover multiple output contexts at once. Since XSS escaping should only be employed on the final output, it doesn't hurt to escape a few more characters. (From your description it sounds like you are processing the data after XSS escaping which is not the idea.)

Example 1:

Welcome <span>[username]</span>!

Here, it would technically be sufficient to just escape < in the username since an attacker cannot inject new tags.

Example 2:

Your new name: <input type="text" value="[username]">

Here, it would be sufficient to escape " to avoid XSS because an attacker can never get beyond the attribute value.

Example 3:

Your website: <a href="[yourlink]">Click me</a>

Here, escaping " in yourlink would avoid breaking out of the attribute but you have to take additional measures to disallow XSS via pseudo links like javascript:foo(). So the standard escaping would be insufficient here.