Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
JS code
var id = $(this).data("id");
$.get("/api.php",{id:encodeURIComponent(id)}).done(function(data){
$('<div>'+data+'</div>').appendTo('.parent');
});
api.php:
echo json_encode('<h1>Hi username!<h1><p>text</p>',JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP);
Returned HTML content is not from a user. It is already written in api.php
Is this query XSS vulnerable? I heard html() is evil. What about appendTo()?
If not user controlled, then it's not vulnerable to XSS.
Someone somewhere must be able to inject script into data to make it vulnerable.
appendTo isn't a sink in itself, however if it's appending free text to the DOM in this case then it could make the page vulnerable if data contains user input (read user input to be anything outside the security domain of the app itself).
var val = $(this).val(); $(.div).css("width", val+"px");
– Swing
Apr 5 '18 at 11:11
onclick for example: .attr("onclick", strXSS)
– dandavis
Apr 5 '18 at 22:39
switch ($id)in api.php. Only 1 var that I get fromdata attr– Swing Apr 5 '18 at 11:03