What are possible XSS vectors to this JavaScript code

new Image().src = encodeURI('[user url here]');

Let's assume two cases:

  • [user url here] is some string provided by user (with no validation)
  • [user url here] is a valid url (validated by Django URLValidator)

I'd imagine there are a lot of vectors for first case, ex.


But what about the second case? Are there any known vectors?

UPDATE: The only vector I can think of is MIME sniffing attack

  • 1
    What about http://localhost/'%2balert(1)%2b'? – Gumbo Jun 13 '14 at 5:23
  • If our payload is not URL encoded, then this payload will cause XSS '-alert(1)-' but if its url encoded as the EncodeURI function is used. This wont work. – Shawar Khan Jan 6 '16 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.