0

It seems like exploiting XSS is becoming harder with every browser version update.

My question is: Is this code vulnerable to XSS?

<script type="text/javascript">
    var url = location.href;
    document.write("URL: " + url);
</script>

1 Answer 1

1

This specific code is unlikely to be vulnerable to XSS, but only because the URL in href was not decoded. For example, visiting bad.html?x=<script>alert("xss")</script> would write the following to to the page:

https://example.com/bad.html?x=%3Cscript%3Ealert(%22xss%22)%3C/script%3E

This is because the <, >, and " characters are encoded as part of the URL.

However, if the javascript on the page was to pass location.href through the decodeURI function first, i.e. writing decodeURI(location.href), it would be vulnerable. The following would be written to the document:

https://example.com/bad.html?x=<script>alert("xss")</script>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .