During regular pentesting of my site I discovered that I can close double quotes in a canonical link tag and enter an onerror attribute with a simple javascript alert(1).

enter image description here

It is visible in source code but javascript did not execute.

enter image description here

I also tried with onload event but same result.

Is there a way an attacker can use different payload to execute javascript ?

  • 4
    How about a >?
    – Bergi
    Mar 24, 2019 at 21:40
  • @Bergi: Could you be more specific ?
    – Rahul
    Mar 25, 2019 at 6:54
  • 1
    You say that " is not properly escaped in the link tag attribute. Does it also accept > or < without transforming it to an entity reference?
    – Bergi
    Mar 25, 2019 at 7:18
  • @Bergi: No it does not. They are filtered out.
    – Rahul
    Mar 25, 2019 at 9:42

1 Answer 1


You can use the same trick as can be used with hidden inputs:

<link rel="canonical" accesskey="X" onclick="alert(1)" />

On Linux, use ALT+SHIFT+X to trigger the payload. IMHO it's enough to report the issue and get it fixed, but it does require some unlikely user interaction.

Other than that, I see no way to exploit this in a modern browser without further code.

While the link tag supports the onload attribute, it only fires when something is successfully loaded, eg:

<link rel="stylesheet" href="http://localhost/test.css" onload="alert(1)">

If your injection were <link href="[user input]" rel="canonical">, then you could exploit it via http://somedomain/somecsssfile.css" rel="stylesheet" onload="alert(1).

The WHATWG spec defines that the first attribute must be used, so it is unlikely that any browser would use the second, so this will not work for your case.

I tried all other event attributes, and none trigger on a normal page load.

This blog post states that this would be exploitable under IE7 and IE8 by injecting a style attribute which then uses an expression to execute JavaScript.

If there is additional JavaScript code that insecurely processes elements, this might also become exploitable (see here for an interesting example).

  • Thanks ! You saved my day. For Windows ALT + X works too. This could be chained with clickjacking (if present in website) to execute Javascript.
    – Rahul
    Mar 24, 2019 at 18:09
  • How to fix the issue then?
    – Nigel Fds
    Mar 25, 2019 at 0:56
  • 1
    @NigelFds: By filtering out characters like ", < and >.
    – Rahul
    Mar 25, 2019 at 6:56
  • 1
    @NigelFds Most - but not all - of the time, you'd want to HTML-encode relevant characters (', ", <, >) when echoing user input. As this is in a URL context, you could also URL-encode the data (see OWASP which also has a good overview of XSS prevention in other contexts, and when encoding of ', ", <, > is not enough).
    – tim
    Mar 25, 2019 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .