2
Is it safe to allow passing the [script URL] as a URL query param?
No, this is very dangerous. See question #3.
If this code is an issue, what are the specific attacks that could happen here?
Since an attacker could pass any script into the URL, and have it run in your sites origin, you are basically opening yourself up to XSS attacks. That is very bad.
...
1
Intrusion Prevention System is a broad term. It basically says only that it is a system to prevent intrusions and does not imply a specific technical implementations. Therefore a variety of systems which somehow had the goal to prevent intrusion, were marketed as IPS when the term was hot. Therefore a generic statement about the capabilities of IPS to solve ...
1
That looks like a real XSS vulnerability, and I do think you should report it.
To get around the problems with the quotes, simply pass a number instead of a string to the alert function, e.g. alert(1). That way, you don't need the quotes but you can still demonstrate that JS is executed. That should be enough to prove that the vulnerability is real.
If you ...
1
This is my own code, and I trust it as far as not having malicious code in it.
This is just an assumption. As long as this assumption is not enforced it can not be relied on. The current proposal allows to load script from arbitrary URL into your page, i.e. completely out of your control. This allows for an XSS attack.
To secure this you need to make sure ...
1
To prevent XSS attacks you should use a multi-faceted approach.
Does escaping quotes in a HTML attribute context prevent XSS?
Let's use the term "contextual output encoding" instead of escaping as part of this conversation.
"HTML Escaping" means you are taking "data" which may be interpreted by the browser as "control / ...
1
At the time of this writing:
Not only did browser filtering fail to stop XSS, but XSS killed browser filtering!
The XSS Auditor (controlled by the X-XSS-PROTECTION header) in all its forms is officially dead. In general, it died because it's goals were simply not realistic. Protecting against even just reflected XSS from the browser-level is just not as ...
Only top voted, non community-wiki answers of a minimum length are eligible
