Consider a website example.com
that allows users to upload arbitrary JS files, that are then stored on the server and served to visitors with a JS content type. Could an attacker use this to perform an XSS attack on example.com
?
At first, I thought the answer was an obvious yes. But thinking about it, it is not obvious how one would do this? If you just point the victim to the URL of an uploaded JS file, the browser will download and display the code, not execute it. Unless there is some other vulnerability, the attacker can't upload HTML files or force existing HTML files to include the script. Including it on evil.com
will not help since it will then not be running in the example.com
origin.
I know there are plenty of security issues with file upload, but here I am only interested in the potential for XSS if you allow upload of JS.