XSS found in the United Airlines website

Question

An XSS bug was found in United Airlines by Strukt and Burelogic (full article here). Apparently they were using this to protect from XSS:

Basically, the code overrides the native alert(), confirm(), prompt(), unescape(), and document.write()functions and nullifies them, so calling them does absolutely nothing. This was implemented as an "XSS protection".

I was wondering if using a base tag to point to a js file with a simple XSS payload would be blocked by the same function that blocked the XSS in the first place.

Answer 1

The CSP will block your JS from a third party website. However, in the event that you manage to find a CSP bypass, XSSObject.proxy will override those functions anyway, because a javascript src runs on the page it is called.