I heard/read at various contexts that DOM based XSS is caused by untrusted client side input and developers need to follow instructions at the OWASP "DOM based XSS Prevention Cheat Sheet" in order to mitigate it.

My question is: Shouldn't this guide be used irrespective of where the malicious payload is injected (client side which can be from DOM elements like URL, or server side which can be from parameters of immediate previous requests) if you are inserting untrusted data into javascript execution contexts?

Lets keep aside the debate of if it will be called DOM based XSS or not in the later case because I am more interested in knowing if this guide should be applied irrespective of where the payload is coming from (server/client) if you are putting untrusted data in <script> execution contexts.

  • Have you looked at the introduction of the OWASP document? It explains the purpose of the document, and it's relation to the more commonly cited XSS Prevention Cheat Sheet. – Anders May 11 '18 at 22:00
  • I did and it does not answer my question :( – user172171 May 11 '18 at 23:17
  • Not sure I understand the question. What do you mean with "parameters of immediate previous requests"? – Anders May 11 '18 at 23:43
  • And when you say "...in script execution contexts", just to be clear, you mean inside script tags? – Anders May 11 '18 at 23:44
  • yes, inside script tags (I think there will be no other execution contexts). Let me put it more clear - "malicious payloads of the request that is triggering the response". – user172171 May 12 '18 at 1:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy