I have the following JS (using jQuery for brevity's sake but it isn't necessary for the question):

$("<i></i>").html(userInput);

Is it possible for someone to input some string, userInput, such that they successfully execute an XSS attack?

I've tried inputting a script tag with an alert in it, but it doesn't execute. I believe that because the element is outside the DOM XSS won't work, but I couldn't find any resources to confirm this.

  • Would this be a reflected XSS attack? If so - some modern browsers will filter those out (Chrome for instance). It looks like a XSS vulnerability to me, but I'd have to test to be sure. – Abe Miessler Feb 3 '15 at 23:14
  • No, we can assume that Chrome or whatever XSS auditor won't be a factor. – winhowes Feb 3 '15 at 23:18
up vote 1 down vote accepted

Never evaluate untrusted input as HTML. Even if the DOM is disconnected (i.e. not inserted in the document), evaluation of HTML can still cause XSS. Your specific example can be exploited using event attributes:

var userInput = '<img onerror="alert(\'XSS\')" src="bogusurl:">';
$("<i></i>").html(userInput);

If you really need to parse untrusted HTML in a browser, use the DOMParser API (with text/html).

Another way to prevent the attack is to use a Content Security Policy Content-Security-Policy with a script-src directive that excludes the 'unsafe-inline' token. CSP is just damage control though, and should not be used as a substitute to proper input sanitization.

  • Really great answer, thanks so much! – winhowes Feb 21 '15 at 22:48

This form of DOM based XSS that is called self-inflected XSS, which can be exploited using Clickjacking. It is DOM based, because JavaScript introduced the XSS vulnerability after the static HTML was rendered by the browser.

Although it can be tricky to exploit self-inflicted xss, this weakness should be avoided, use $('<i></i>').text(userInut), or escape the HTML.

  • Yeah unfortunately I can't use .text()/.textContent. The context of this is taking a string of html, doing some element manipulation and outputting a string of html. As this won't ever be visible to the webpage I'm not sure those attack vectors exist in this context. – winhowes Feb 4 '15 at 4:17
  • @winhowes xss can always be avoided. – rook Feb 4 '15 at 5:28

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.