In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then they create a link like this:

<a href="http://google.com"> google </a>

So, if you try to input "javascript:alert(1)", the link would be

<a href="http://javascript:alert(1)"> google </a>

If they would not concatenate the "http://" at the beginning, that javascript would execute when the link is clicked. So, we can be sure that that is 100% safe from XSS because they always concatenate the "http://" at the beginning?

Thanks! Note: If you input quotes, they encode them as \u003ca

  • In this case that would not work because they encode quotes as \u003ca – Samuel Jun 11 '19 at 22:11
  • What if I encode " with %22 ? – Rahul Jun 12 '19 at 12:25
  • @Rahul I thnik it would just be displayed as " but not executed – CDRohling Jun 12 '19 at 13:10

I don't think this method would be safe from XSS. This type of vulnerability sounds like a typical case of Reflected XSS. If you would escape the href tag with some " you can enter a XSS code. Your link would look like this if you enter foo.at"><script>alert(81)</script>"page=1 into the input field ->

<a href="http://foo.at"><script>alert(81)</script>"page=1">google </a>

I would suggest to use a filter on the website which converts all special chars to an other format. Like htmlspecialchars in php.

  • with this note Note: If you input quotes, they encode them as \u003ca, I meant you cannot do that specifically – Samuel Jun 11 '19 at 22:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.