1

Sample code:

function winLoad() {
    var sessionId = '';
    if (window.location == window.top.location) {
        var semicolonIndex = window.location.href.indexOf(';');
        if (semicolonIndex != -1) {
            var questionMarkIndex = window.location.href.indexOf('?');
            if (questionMarkIndex != -1) {
                sessionId = window.location.href.substr(semicolonIndex, questionMarkIndex - semicolonIndex);
            } else {
                sessionId = window.location.href.substr(semicolonIndex);
            }
        }
    }
};

Is it possible to inject arbitrary Javascript commands with the URL like this: https://example.com;';alert(document.domain);'? The input does not get reflected on the site and I've been trying to figure out how to close the string and add arbitrary commands right after it using browser consoles:

  1. not a malicious payload https://example.com/foo;bar -> ";bar" in FF and ';bar' in Chrome
  2. malicious payload https://example.com/foo;';alert(document.domain);' -> ";';alert(document.domain);'", input get surrounded by double quotes
  3. malicious payload https://example.com/foo;";alert(document.domain);" -> ";%22;alert(document.domain);%22", double quotes get encoded

I've also been trying to look up if the location.href method encodes double quotes only in some parts of the URL (path /foo/, query ?foo=bar and hash #foo) but so far it seems that they always get encoded.

Improve this question
4
  • This piece of code does nothing special. Some text is assigned to a variable. Why do you expect anything special from this code? If this code is used somewhere else, then provide the full code.
    – mentallurg
    Jan 6 at 0:20
  • Well I thought I could bypass encodings to end up with something like this: sessionId = ";foo";alert(1);"" which I thought would cause a popup. But guessing from your answer I assume this doesn't work and you need some sort of a sink function that takes the payload as input?
    – jne
    Jan 6 at 11:52
  • Why do you think that just assigning some text to variable like a = "alert(1)" should execute this text?
    – mentallurg
    Jan 6 at 12:48
  • I don't, what I thought I could do was this: initially the variable is declared like this a = "" and then after my input it will look like this a = "";alert(1);"", where my input is ";alert(1);" . Maybe I'm under the wrong impression that this would close the double quotes of a, insert the alert(1) function and then add another double quote for the hanging double quote. So I would be left with a = ""; followed by alert(1); followed by "". So alert(1) would not be part of the string.
    – jne
    Jan 6 at 12:56

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.