Consider a website
example.com that allows users to upload arbitrary JS files, that are then stored on the server and served to visitors with a JS content type. Could an attacker use this to perform an XSS attack on
At first, I thought the answer was an obvious yes. But thinking about it, it is not obvious how one would do this? If you just point the victim to the URL of an uploaded JS file, the browser will download and display the code, not execute it. Unless there is some other vulnerability, the attacker can't upload HTML files or force existing HTML files to include the script. Including it on
evil.com will not help since it will then not be running in the
I know there are plenty of security issues with file upload, but here I am only interested in the potential for XSS if you allow upload of JS.