Is this code vulnerable to DOM XSS?

Question

const scriptElement = document.createElement('script');

// Set the source (src) attribute
scriptElement.src = '/evil.js?'+decodeURI(urlParams['sync']);

// Append the script element to the HTML document
document.body.appendChild(scriptElement);

Can I not inject "> and break out of the src attribute?

Answer 1

No, you cannot manipulate the HTML structure through the sync parameter, because the src property of the JavaScript HTMLScriptElement object has the sole purpose of programmatically setting the source URL of this element. The string does not get parsed as HTML markup, so characters like " or > are taken as literal text within the URL and have no special meaning.

You will need a JavaScript feature which lets you manipulate HTML like the innerHTML property or document.write.

Note that I'm assuming the evil.js part of the URL is fixed by the website owner. If you as the attacker can set the entire URL, then you can of course inject arbitrary JavaScript code through the script element.