1

On this website, you can specify your YouTube channel URL and it makes a button on the profile page that will go to that URL. This text entry has no restrictions other than that it has to be less than 200 characters and that it has to start with youtube.com/user/, but it allows any characters after the /user/.

Are there any browsers that will treat certain characters in the URL specially and escape the URL? The only reason I ask is because as I said I can use any characters, so if I could escape the URL and run my own code with data URIs it could pose a threat.

  • By escape, do you mean encoding e.g. replacing a space with %20? – forest Jul 10 '18 at 2:57
2

Not sure exactly what you mean by "escape the URL", but I can think of three sneaky things related to URL:s to try in a situation like this:

  • XSS: If there is no escaping at all, you might try an URL like " onClick="alert('XSS');. However, basic XSS filtering or just URL encoding the URL will make this hack impossible.
  • Change protocol or scheme: You mention data://. An other popular trick is javascript: or vbscript:. All these have in common that they have to be at the beginning of the URL to do anything. If the URL starts with a hardcoded part, like youtube.com, you're out of luck.
  • Open redirects: If YouTube has an open redirect, you could create a link that takes the user anywhere on the internet. If the user expects to end up on YouTube, but instead ends up on a site you control, you could use that for phishing. I'll admit that this isn't exactly the most powerful attack, but it shouldn't be ignored either.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.