I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible to misuse it for an XSS attack? My idea is to use lots of ranges to generate a XSS from a given file (if it is big enough and contains all necessary characters).
Request:
...
Range: bytes=x1-x2,x3-x4,x5-x6
...
We take only such ranges which we need to produce a new message. But the response looks like following:
Response:
--99999999999999999999<br>
Content-Type: application/x-javascript<br>
Content-Range: bytes x1-x2/FILE_SIZE<br>
<script>
--99999999999999999999<br>
Content-Type: application/x-javascript<br>
Content-Range: bytes x3-x4/FILE_SIZE<br>
alert
--99999999999999999999
Content-Type: application/x-javascript
Content-Range: bytes x5-x6/FILE_SIZE
('
--99999999999999999999--
Is it possible to disable (on client side) these additional lines so that the response won't be splitted as shown above: (?)
--99999999999999999999
Content-Type: application/x-javascript
Content-Range: bytes x5-x6/FILE_SIZE
Some set of byte ranges → <script>alert('XSS');</script>
