0

I have this snippet of code :

<script type="text/javascript">
        $.extend({
                getUrlVars : function() {
                        var vars = [], hash;
                        var hashes = window.location.href.slice(
                                        window.location.href.indexOf('?') + 1).split('&');
                        for ( var i = 0; i < hashes.length; i++) {
                                hash = hashes[i].split('=');
                                vars.push(hash[0]);
                                vars[hash[0]] = hash[1];
                        }
                        return vars;
                },
                getUrlVar : function(name) {
                        return $.getUrlVars()[name];
                }
        });

        $(document).ready(function() {
                //Getting URL var by its nam
                var langVal = $.getUrlVar('lang');
                $('#lang').val(langVal);
        });
</script>

And I want to know , how secure it is.Is there any danger of dom xss and if yes , then how? Thanks

1 Answer 1

1

In its current state, your code doesn't have a DOM XSS vunerability. $.val sets the value of a form element, which cannot be used to inject JavaScript code into a website.

The innerHTML property or document.write are examples for methods that are vulnerable to DOM based XSS.

You should read up on this topic on the OWASP website. There's also a talk here about this topic (if I recall correctly, it was mostly about a tool to detect DOM based XSS, but also has an introduction to the topic).

1
  • Thanks you , now I can implement it in code. And thanks for links , I tried Dominator but got nothing, but tools make mistake so I asked.
    – Daniel
    Apr 25, 2013 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .