I understand that dynamically appending a script tag to DOM could lead to XSS attacks if script's URL isn't properly secured and my.remote.domain.com isn't whitelisted as an allowed domain to load and execute scripts from.

Example (code running on https://my.original.domain.com) :

var myScript = document.createElement('script');
myScript.src = 'https://my.remote.domain.com/path/to/myScript.js';

However when I ran CSP Mitigator tool, it didn't complain about having these script tags attached. Is it because such tool can only run and inspect DOM elements rather than read through scripts code as well ? And if so, are there good tools out there to detect such code issues ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.