1

there is this javascript file that a can inject code after throw new Error("error string") line. But it seems that after the throw statement, no code can be executed.

throw new Error("error string");
<my xss code here>

if there was no semicolon at the end of the statement I think it would possible to run code by a conditional(ternary) operator like this:

throw new Error("error string")
? 1==0: code

Is there any way to run code after the throw statement? maybe an undocumented way?

Improve this question
7
  • you can continue only if you catch it.
    – pcalkins
    Mar 17 at 19:37
  • Unfortunately I can't catch because I only control the code after the throw new error line and the is no "try" before it so I would include a catch
    – nv92Cczb1
    Mar 17 at 19:46
  • maybe try with window. onerror()
    – pcalkins
    Mar 17 at 20:00
  • 1
    This is a pure programming question. I suggest to move it to SO.
    – mentallurg
    Mar 17 at 20:05
  • window.onerror don't seems to work, i'll move this question to programming
    – nv92Cczb1
    Mar 17 at 20:32

2 Answers 2

Reset to default
2

There are a lot of unexpected corners of the language that could change the control flow. There may be new ones added in future versions of JavaScript To be safe, I would always assume that allowing to inject code anywhere is potentially a vulnerability.

For your particular example, it is enough to change the Error constructor through a locally hoisted definition. The code below will output “XSS” to the console.

throw new Error("error string");
function Error() { console.log('XSS'); }
Improve this answer
0
2

If you're really injecting inside a javascript file then I can't see a way to continue execution. If you're injecting inside a script tag in an html document, then you can close the script tag and open a new one, which will be executed independently.

Improve this answer
1
  • The injection point is inside a javascript file, maybe I should move on and look for bugs elsewhere, thanks.
    – nv92Cczb1
    Mar 17 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .