<div id="cat"></div>
<script>
$("#cat").html(location.pathname);
</script>

I think that example would work, but anyway, if location.pathname has to be a valid page, can this be exploited?

Edit: I'm mainly talking about if the user can't make up their own pathname, (i.e. /test/<script>alert(0)</script>).

up vote 2 down vote accepted

Yes, if a path containing script tags is resolved to the page containing this code on your server (for example, via a rewrite rule) then script could be rendered in your page. This will be DOM based XSS as it will be your client-side code that is adding the script tag.

e.g. https://www.example.com/foo/bar/<script>alert('foo')</script>

  • Thank you. Is the only way it could be exploited if it allows the .htaccess rewrite rule? What if the javascript was contained in /example/example.html only? – Michael Blake Aug 18 '14 at 9:56
  • 1
    @MichaelBlake: Depends on the tech stack - anything on the web server, load balancer, etc, that allows a URL containing script tags to resolve to the page could trigger the XSS. – SilverlightFox Aug 18 '14 at 9:59
  • Thank you. That's what I thought. I was just making sure there was no creative way for an attacker to stay on current page, but add their attack, that'd be carried to location.pathname (if that makes sense). – Michael Blake Aug 18 '14 at 10:03
  • 1
    @MichaelBlake: A more secure way is to use text rather than html rather than rely on this as a security measure. – SilverlightFox Aug 18 '14 at 10:06
  • I'm going to go ahead and allow anyone else to add any input, then I'll mark this as an answer. Thank you. – Michael Blake Aug 18 '14 at 10:08

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.