java script in link href=“javascript:alert(1)”

Question

In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then they create a link like this:

<a href="http://google.com"> google </a>

So, if you try to input "javascript:alert(1)", the link would be

<a href="http://javascript:alert(1)"> google </a>

If they would not concatenate the "http://" at the beginning, that javascript would execute when the link is clicked. So, we can be sure that that is 100% safe from XSS because they always concatenate the "http://" at the beginning?

Thanks! Note: If you input quotes, they encode them as \u003ca

Answer 1

I don't think this method would be safe from XSS. This type of vulnerability sounds like a typical case of Reflected XSS. If you would escape the href tag with some " you can enter a XSS code. Your link would look like this if you enter foo.at"><script>alert(81)</script>"page=1 into the input field ->

<a href="http://foo.at"><script>alert(81)</script>"page=1">google </a>

I would suggest to use a filter on the website which converts all special chars to an other format. Like htmlspecialchars in php.