I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (// after the first :). Due to the myriad of exploitable protocol handlers, this is certainly a bad idea. But does it allow XSS on a system without vulnerable protocol handlers?

All browsers I tested (Chrome 22, FF 18, IE 9, Opera 12) do not show anything when pointed to javascript://alert('XSS'), but that could certainly just be because I'm not creative enough. Similarily, javascript://alert('XSS') (which would make the first double slashes a comment, and the alert a new line) doesn't work either.

  • 1
    This isn't really an on-topic question - it falls well within the normal handling of URL's. – Rory Alsop Feb 5 '13 at 18:09
  • 2
    @RoryAlsop Sorry, I'm new to sec.sx. Could you elaborate why this question is off-topic? (and why you didn't close it as such?) Isn't this related to web app hardening, the first item in the list of topics? And how come dozens of quite similar questions about XSS details are still open? – phihag Feb 5 '13 at 18:12
  • 1
    @phihag - Your question is whether a commented out part of a JavaScript code can be executed by browsers, and then answer your very own question within the same minute that they don't if it's contained in the same line that was commented out. Of course, the JavaScript command that was moved to a new line that isn't commented out will be processed. It doesn't matter if the new line identifier was written using escape characters, which is rather obvious, isn't it? Being part of a HTML document, it is parsed by the browser, escape characters including. What's strange here? – TildalWave Feb 5 '13 at 18:24
  • 1
    @TidalWave Note that I answered within the same second, and I see nothing wrong with that. I should've asked you guys earlier; for me, it wasn't obvious at all. I just inserted a newline (or ) and didn't realize that although that does not work, simply urlencoding does. – phihag Feb 5 '13 at 18:37
  • 2
    Reopened - thanks for the discussion on the DMZ to help clarify. – Rory Alsop Feb 5 '13 at 18:42

Yes, it allows XSS. You can inject a newline after the // if you use the right trick. The // makes the line a comment, but the newline is (as whitespace) not allowed in a URL, htmlencoded or not. Simply urlencode it, like this:

<a href="javascript://%0Aalert('XSS');">XSS</a>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.