Data is read from window.location and passed to the wrap() function of function of jQuery via the following statement:


The version of jQuery in use is the 1.12.1 - Is this code vulnerable to DOM based XSS?

  • Difficult to tell when we don't know what t.Location is. Would you be willing to add more context and detail to your question?
    – EdOverflow
    Feb 4 '19 at 16:37
  • try it with a script tag. if it calls .html() internally, it's likely vulnerable.
    – dandavis
    Feb 4 '19 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.