0

I have this snippet of code :

<script type="text/javascript">
        $.extend({
                getUrlVars : function() {
                        var vars = [], hash;
                        var hashes = window.location.href.slice(
                                        window.location.href.indexOf('?') + 1).split('&');
                        for ( var i = 0; i < hashes.length; i++) {
                                hash = hashes[i].split('=');
                                vars.push(hash[0]);
                                vars[hash[0]] = hash[1];
                        }
                        return vars;
                },
                getUrlVar : function(name) {
                        return $.getUrlVars()[name];
                }
        });

        $(document).ready(function() {
                //Getting URL var by its nam
                var langVal = $.getUrlVar('lang');
                $('#lang').val(langVal);
        });
</script>

And I want to know , how secure it is.Is there any danger of dom xss and if yes , then how? Thanks

1

In its current state, your code doesn't have a DOM XSS vunerability. $.val sets the value of a form element, which cannot be used to inject JavaScript code into a website.

The innerHTML property or document.write are examples for methods that are vulnerable to DOM based XSS.

You should read up on this topic on the OWASP website. There's also a talk here about this topic (if I recall correctly, it was mostly about a tool to detect DOM based XSS, but also has an introduction to the topic).

  • Thanks you , now I can implement it in code. And thanks for links , I tried Dominator but got nothing, but tools make mistake so I asked. – Daniel Apr 25 '13 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.