2

If you have an HTML file that contains the following code :

   <!doctype html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
    </head>
    <body>
        <script type="text/javascript">
            var a = '</script><script>alert("xss")</script>'
        </script>
    </body>
    </html>

when opening it in a browser, it will incorectly (?) alert "xss".

  • Is this normal behaviour for browsers (in my case the latest Chrome) to interpret JavaScript strings as being valid tags ?

1 Answer 1

3

Yes it's normal.

HTML is parsed first, then JavaScript. So, after encountering a <script> start tag, the browser will look for the closing </script> tag. When that's found, the collected string will be parsed as a script if the type (usually and defaults to JavaScript) is recognizned.

If you use the DOM inspector (F12, or right-click -> Inspect Element), then you'll see the following tree. In the JavaScript console, you'll also see that a script error has occurred (the first string is not terminated).

The third </script> tag is not visible in the screenshot, because the DOM parser did not find a corresponding start tag. So it's omitted.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .