An XSS bug was found in United Airlines by Strukt and Burelogic (full article here). Apparently they were using this to protect from XSS:
Basically, the code overrides the native
alert()
,confirm()
,prompt()
,unescape()
, anddocument.write()
functions and nullifies them, so calling them does absolutely nothing. This was implemented as an "XSS protection".
I was wondering if using a base tag to point to a js file with a simple XSS payload would be blocked by the same function that blocked the XSS in the first place.
script
. Or are you suggesting that you should set base href to a domain that you control, and then host the code without the XSS protections there? – Anders Nov 19 '17 at 11:27