New answers tagged jquery
1
Yes, it's possible to do something malicious with jQuery(window.location.hash). See this archived blog post which was mentioned in a comment to an answer in another SE question. A CSS timing attack can be done, as was described in the blog post:
If we execute the selector *:has(:has(:has(*)) :has(*) :has(*)) input[name=authenticity_token][value^='x'], it ...
Top 50 recent answers are included
