As far I know, when using 3rd party library of client side programming language/Javascript, you are vulnerable to XSS attack.

Is it also vulnerable when using 3rd party library in server programming language (PHP/Golang/Java) like XSS attack in 3rd party router library?

Maybe it's silly question, but I don't know where to start. Thank you.

  • server-side attacks are far more dangerous and any code you don't write or examine can contain problems.
    – dandavis
    May 14, 2018 at 20:28

1 Answer 1

  1. The definition of XSS means it's client side. The XS stands for cross site.
  2. XSS does not require 3rd party code.
  3. Third party code is not an inherent security threat. Code you write yourself likely isn't as good, likely hasn't been tested as much, and hasn't received enough scrutiny for security problems. (Third party includes, however, have many non-XSS security issues.)
  • 1
    I don't think it's right to say it's client-side. If, on the server, a consumer of some service somewhere receives a response with malicious script in it and fails to sanitize prior to rendering it out - that didn't necessarily originate from the client.
    – user81147
    May 14, 2018 at 22:50
  • 1
    @JᴀʏMᴇᴇ the client side is what is affected by it, although it is partially or completely mitigated from the server side in most cases. May 14, 2018 at 23:18
  • I agree with @JayMee, because it's correct to say client side is affected, but the vulnerabilty could exist on server side, for example: <?php echo $_GET['input']; ?>; this code is executed from server side and the vulnerability exist in this part, also a mitigation should be applied in that code, even the main recommendation is validating and encoding data on server side.
    – hmrojas.p
    May 16, 2018 at 22:35
  • Now, if you browse known vulnerabilities of frameworks or 3rd party code (dependencies), you could find some XSS vulnerabilities in those technologies, so you could code in a correct way, but if you have a vulnerable 3rd party code in your application then it could be vulnerable to XSS.
    – hmrojas.p
    May 16, 2018 at 22:35

You must log in to answer this question.