New answers tagged

2

32 characters are plenty for this case. Without a src, you are at 19 chars. 17 if you omit " around src, 16 if you omit the a (so you get "><script src=>). You need two chars for the protocol (//) and nothing for the filename (just serve it from root). Which leaves you with 14 chars for the domain name. You can easily register a domain with 5 ...


2

XSS is the ability to execute javascript code (i.e. alert(1)). HTML injection is the ability to execute HTML (such as <p>, like you said). Often they go hand in hand. When <script> tags are deleted by a filter of the web app, attackers can often still achieve to execute javascript (XSS) by leveraging HTML injection through: <img src='x' ...


2

You need to sanitize the content before embedding it in your HTML output, otherwise you are guaranteed to have XSS vulnerabilities in there. Please do not reinvent the wheel, as there are great sanitizers out there, that you can utilize. I highly recommend using DOMPurify, which is also integrated in several widely used JS frameworks to reliably protect ...


Top 50 recent answers are included