My attack vector is being passed in three contexts.

  1. HTML element: <p>injection</p>
  2. HTML attribute value: <input value="injection">
  3. Javascript: <script> var a = "injection"; </script>

In all these contexts, my payload is rendered as HTML-encoded values (single-quotes, double-quotes, angle brackets). I am aware this pretty much rules out XSS exploitation through the first two contexts, but is the third context also secure?

OWASP guides developers to javascript escape untrusted data before inserting it into javascript context which isnt the case here. Is there anyway to bypass this?

  • You basically answered your own question, if quotes are encoded you can't break out of the variable "a". Having said that, it also depends on where and how the variable "a" is used in the rest of the javascript code. – Jeroen Apr 20 '18 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.