How to execute an XSS attack against a site that uses client side protection?

Question

Say I have a site that allows me to save my name to the database, and that name is then displayed to other users.

I have determined that if I save the following as my name:

Abe <script>alert(1);</script> Miessler

Another page in the site will take the following steps all on the client side:

1. Make an AJAX request to get a list of user names
2. Return those unencoded values (so <scrip.... is returned not >scrip.....)
3. The page then HTML encodes any values that were returned and renders them on the page

I know that one should not count on anything on the client side for security, but I cannot think of a scenario where an attack would be able to get through here. Can it be done?

Answer 1

I know that one should not count on anything on the client side for security

This message has become slightly garbled. Really, it should be that the security measure needs to be done on the same side of a security boundary as the system it is protecting. For the common case of a forms-based web app that makes the server side the place where the attack might happen, and the server side the place where the defence has to be done.

But in your case the possible vulnerability, DOM-XSS, occurs in the client browser, so putting the defence against it (proper HTML escaping and/or using DOM methods instead of markup to write the content) on the client too is correct.