4

Backstory: Stack Exchange's markdown parser allows a couple of HTML tags (a,b,i,img) through, with some restrictions on the attributes to prevent XSS. We're thinking of requesting the <cite> tag to be allowed so people can include citation metadata in the script.

So, the question is, does allowing the <cite> tag to be used in user-submitted content expose any XSS (or similar) vulnerabilities? As far as I can tell, the tag is harmless as it only contains metadata (which may be rendered by extensions or the like).

  • No. Allowing non-executable tags (e.g. cite) would not create XSS. – Albert Mar 14 '14 at 15:12
3

Looking at the definition for the cite tag it doesn't look like in and of itself it's likely to introduce XSS issues as in most uses it's a bare tag without JavaScript style parameters.

The only potenial issue I could see is if it interacts badly with the code that is being used to filter content in a tags as a tags can be nested inside cite tags, but that's mainly just a filter implementation issue rather than a fundamental problem.

0

While it is true that the bare tag of cite itself will not cause any XSS issues, however, with the addition of javascript event handler, XSS would be possible.

However, StackExchange would most probably block all of the javascript event handlers(or whitelist the number of allowed attributes) so I believe this is not an issue.

Vector: Click Me! Sample: http://jsfiddle.net/m2zRD/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.