0

JS code

var id = $(this).data("id");
$.get("/api.php",{id:encodeURIComponent(id)}).done(function(data){
    $('<div>'+data+'</div>').appendTo('.parent');
});

api.php:

echo json_encode('<h1>Hi username!<h1><p>text</p>',JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP);

Returned HTML content is not from a user. It is already written in api.php

Is this query XSS vulnerable? I heard html() is evil. What about appendTo()?

Improve this question
2
  • Are you sure no part of the string is controlled by the user? Does it literally say "username", and not the actual username from the database? – Anders Apr 5 '18 at 10:54
  • @Anders Yes, that's just random text for example. In api.php I sanitize and use var id for switch ($id) in api.php. Only 1 var that I get from data attr – Swing Apr 5 '18 at 11:03
1

If not user controlled, then it's not vulnerable to XSS.

Someone somewhere must be able to inject script into data to make it vulnerable.

appendTo isn't a sink in itself, however if it's appending free text to the DOM in this case then it could make the page vulnerable if data contains user input (read user input to be anything outside the security domain of the app itself).

Improve this answer
2
  • Thank you! How I can prevent bad code in data attr value? Is it enough to sanitize $GET in api.php? And if I use data-attr or input val values only in JS Should I sanitize them in JS? For example: var val = $(this).val(); $(.div).css("width", val+"px"); – Swing Apr 5 '18 at 11:11
  • you don't need to sanitize input value or style set by JS; the browser does that for you. you do need to watch arbitrary attributes set by JS, like onclick for example: .attr("onclick", strXSS) – dandavis Apr 5 '18 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.