As a simple example, let's assume that I have implemented a key-value lookup within a pre-populated, static JavaScript dictionary. Let's say that the dict is:

a = { 'one': 'uno', 'two': 'dos' };

The dict is accessed with


For example


will display a page showing uno. An attacker may attempt to exploit this using an XSS payloads such as


The JavaScript has a whitelist lookup against legal keys and performs no actions if the whitelist lookup fails. Basically

arg = window.location.hash.substr(1);
if (a.indexOf(arg) != -1) {
  // do stuff

Even though the attack fails, the anchor portion of the URL in the URL bar continues to have the script code in it.

What are the risks of leaving this malicious-looking anchor in the user's URL bar?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.