If I have javascript that opens a window using the code below, the content is a user supplied variable that is not sanatized. Is there any security risk in this situation. The content will only be show back to the same user. No additional user will see this content.

The content can be anything like


  var mywindow = window.open('', '_blank');

Which will diplay the alert box in this case, but it's only shown to the user, that supplied the content. For example, if someone was to type in HTMl to see how it looks it will show how it looks in the new window that pops up.

I feel like I'm being overly cautious, but that's a good thing, Just want to make sure I'm not missing something in this situation.

1 Answer 1


It sounds like there are two concerns here: Is this example vulnerable to XSS? And is it vulnerable in a way that poses a legitimate security concern?

To answer question one, your example is definitely vulnerable to self-XSS. When opening a blank window, the origin is set to that of the window that opened it. So any script run in the window will be able to read cookies and make requests to your site, just the same as if it was running in the same window.

Whether this is a "real" vulnerability depends on the context. Self-XSS is often viewed as a less critical issue than reflected or stored XSS. Some don't consider it a security problem at all. But keep in mind, it's possible that an attacker could try to convince your users to paste malicious code into the preview form, for example, and steal their session token or other sensitive information.

If you want to prevent that, one mitigation I have seen is to open the new window in a different domain. The same-origin policy would then protect resources associated with your main site. See this excellent video by LiveOverflow for more discussion on how sandboxed domains are used to neutralize XSS vulnerabilities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .