1

If I have...

<table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could put alert(0), and that would set off when clicked, but I don't know if it's possible with this case.

  • 3
    You’re already in an attribute value that is interpreted as JavaScript. – Gumbo Jul 7 '14 at 7:27
  • @gumbo but can I run my own javascript? The "texttexttext..." is already there, so if I were to put alert(0), it wouldn't work. – Michael Blake Jul 7 '14 at 7:29
  • 1
    Of course you have to choose your injected code so that the resulting attribute value is valid JavaScript. For example, if the injection is inside a JavaScript string literal, you have to leave it before being able to use arbitrary JavaScript. So what exactly is the code before the injection point? – Gumbo Jul 7 '14 at 7:47
5

It's very possible:

texttexttext=function(){};alert(document.cookie); 

Would give you execution of your code, regardless of what the string literal is. You just make it into a unused function - and you execute everything after that.

Edit: plus - you can often use single quotes as a substitute for double quotes.

1

Probably want to use a hidden input form field for storing user input instead of putting it inline. You can sanitize it before storing it but in this example its sanitized on demand.

The actual sanitizing of the user input can be done at different times in different languages, so is just abstracted with jazzhands.

<script>
    var myNamespace = {};
    myNamespace.sanitize = function (ickyUserInput) {
        var sanitizedUserInput = "*jazzhands*";
        //do real work here
        return sanitizedUserInput;
    }
    myNamespace.tableClick = function (tableClickParameter) {
        var userInput = myNamespace.sanitize($('#userInput1').val());
        //do work without fear of bad users
    };
</script>

<table onclick="myNamespace.tableClick('texttexttexttext')">
    <tr><td>Hi mom!</td></tr>
</table>

<input id="userInput1" type="hidden" value="=function(){};alert(document.cookie);" />

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.