0

This question already has an answer here:

I am testing a web application where input from the user is inserted without encoding into the response, but the content type of the response is text/javascript;charset=UTF-8.

Input from two parameters from the user application returns inside the JavaScript like this:

throw 'allowScriptTagRemoting is false.';
//#DWR-INSERT
//#DWR-REPLY
var s0={};
dwr.engine._remoteHandleCallback('1','0',{application:"param1",changedParts:null,module:"param2",nextModule:null,reload:true,showDialog:false,strokeActions:s0,viewMember:""});

But when I am trying to end the remoteHandleCallback by inserting " and }, these characters are escaped with backslash and treated as a part of the string, for example:

application:"\"param1"

Is this a proper defense against XSS and other vulnerabilities?

marked as duplicate by Anders, Steve, AJ Henderson, Xiong Chiamiov, Steffen Ullrich Nov 1 '17 at 17:36

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Also, you could try the double escaping trick - what happneds if you pass \"? – Anders Oct 31 '17 at 12:53
  • seems like JSON encoding, which has simple rules you can lookup. – dandavis Oct 31 '17 at 23:40
0

Since the response type is text/javascript, this is probably a js file being loaded and used. Loading this file directly in the browser will most likely not trigger an XSS even if you could inject the payload because of the content type not being text/html. See the following question for more info. If the response header content-type-options: nosniff is included, the risk is reduced further.

Since both " and } are properly encoded, it will be difficult to exploit. You could try different encodings to bypass the security encoding.

So all in all it looks like a proper defence against XSS.

Not the answer you're looking for? Browse other questions tagged or ask your own question.