2

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? 

console.log(name)

When I send an injection in name variable I see its value printed by console.log as a URL encoded string, and it does not get interpreted as a script tag format. Is there a way to exploit this to XSS attack ?

Improve this question
4
  • 2
    in which language have you crafted these lines ?
    – user45139
    Dec 27, 2014 at 22:08
  • javascript, it's inside a javascript function
    – kassr
    Dec 27, 2014 at 23:11
  • i tried to inject the following payload: fname=alert(1); but it didnt work
    – kassr
    Dec 27, 2014 at 23:12
  • Script injection doesn’t apply to console.log output…
    – Ry-
    Dec 28, 2014 at 1:21

2 Answers 2

Reset to default
4

No the exact code you have posted is not vulnerable to XSS.

Now if you are writing first_name to the page anywhere it could be a reflected XSS vulnerability or maybe a DOM based XSS vulnerability. But the tiny piece code you have posted is not a vulnerability

Improve this answer
-5

It is useless to try to find an XSS vulnerability within pure JavaScript code.

XSS vulernabilities are useful when the website offers to you the opportunity to interact with PHP/MySQL inputs/URLs. We can not talk about XSS in your case.

Improve this answer
1
  • 4
    Dnakki your answer is completely wrong and quite harmful. OF COURSE there can be XSS in javascript-only code. Obviously XSS is not just about PHP (even though it is very common there), and it has absolutely nothing to do with MySQL (or any other database for that matter). I suggest you read up a bit on so-called "DOM-Based XSS" or "client-side XSS".
    – AviD ♦
    Dec 28, 2014 at 14:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .