<div id="cat"></div>

I think that example would work, but anyway, if location.pathname has to be a valid page, can this be exploited?

Edit: I'm mainly talking about if the user can't make up their own pathname, (i.e. /test/<script>alert(0)</script>).


Yes, if a path containing script tags is resolved to the page containing this code on your server (for example, via a rewrite rule) then script could be rendered in your page. This will be DOM based XSS as it will be your client-side code that is adding the script tag.

e.g. https://www.example.com/foo/bar/<script>alert('foo')</script>

  • Thank you. Is the only way it could be exploited if it allows the .htaccess rewrite rule? What if the javascript was contained in /example/example.html only? – Michael Blake Aug 18 '14 at 9:56
  • 1
    @MichaelBlake: Depends on the tech stack - anything on the web server, load balancer, etc, that allows a URL containing script tags to resolve to the page could trigger the XSS. – SilverlightFox Aug 18 '14 at 9:59
  • Thank you. That's what I thought. I was just making sure there was no creative way for an attacker to stay on current page, but add their attack, that'd be carried to location.pathname (if that makes sense). – Michael Blake Aug 18 '14 at 10:03
  • 1
    @MichaelBlake: A more secure way is to use text rather than html rather than rely on this as a security measure. – SilverlightFox Aug 18 '14 at 10:06
  • I'm going to go ahead and allow anyone else to add any input, then I'll mark this as an answer. Thank you. – Michael Blake Aug 18 '14 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.