My application is returning category parameter in json body as the following response..

HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
P3P: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
Server: nginx
X-frame-options: SAMEORIGIN
Content-Length: 139
Accept-Ranges: bytes
Date: Mon, 26 Jun 2017 15:47:55 GMT
Connection: keep-alive
Set-Cookie: bf-geo-country=EG; expires=Tue, 27 Jun 2017 15:47:55 GMT; path=/; do                                                                main=.myapp.com;
Content-Security-Policy: upgrade-insecure-requests
Strict-Transport-Security: max-age=120; preload
X-Served-By: cache-hhn1524-HHN
X-Cache: MISS
X-Cache-Hits: 0    
Vary: Accept-Encoding

   "response" : "an error occurred",
   "campaign_monitor_errors" : [
      "no config for Newsz<htMl onload=prompt(22)/></html>"

Can this lead to Reflected XSS by MIME sniffing in IE or Chrome ?

  • what happens in IE or Chrome when you test it? – mcgyver5 Jun 26 '17 at 17:23
  • Chrome views response as TEXT , IE downloads it. – Yasser Gersy Jun 26 '17 at 17:36
  • 1
    Are quotes escaped? This looks non-vulnerable to me. There is a potential risk of DOM XSS depending on what the client-side JavaScript does with the data. – paj28 Jun 27 '17 at 17:08
  • Json always escape quotes " -->> \" – Yasser Gersy Jun 29 '17 at 3:21
  • @YasserGersy - In that case I think DOM XSS is the only risk. BTW, although rare, it's certainly possible that a JSON generator fails to escape quotes. – paj28 Jun 29 '17 at 20:16

Short answer is that the parameter should be encoded regardless. As paj28 mentions in above comment, it depends what client side page does with the data.

The book, "The Tangled Web" by Michal Zalewski has a chapter about content detection. He says, "In the history of the web, nothing has proven to be as misguided as content sniffing."

He gives advice at the end of the chapter. Primary tip from this book and from other sources is to use the X-Content-Options: nosniff header to prevent the browser from sniffing the content and coming up with its own answers and ignoring your content-type header.

Your browser's reaction to the actual JavaScript in your example will depend on the browser version. Note:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.