I've been looking at a few issues related to XSS. In doing so, I've stumbled upon a few "XSS Filter Evasion" type checklists that demonstrate supposed XSS via data URIs. For example:
- The last line of: https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec
- Or this security report: https://nodesecurity.io/advisories/remarkable_xss-in-data-uri
- Or this blog post: https://deadliestwebattacks.com/html-injection-quick-reference/
It's obvious that clicking a link (such as the one below) would cause an alert to appear in the browser.
However, this code (as far as I can tell) will not be executed on the same origin as the page that contains the anchor tag.
Why are people calling this an XSS vector? Is there something I'm missing that makes this an issue?