A friend of mine, Tristan Burch, encountered this issue today. It is present in all browsers and has been closed as invalid in firefox.
|
1 2 3 |
<script> var test = "</script><script>alert('injection attack');</script>"; </script> |
The browser’s HTML parser doesn’t know anything about JavaScript, so it interprets the closing script tag within the string. The above snippet results in an XSS vulnerability.
The lesson here, is that it is dangerous if you place user submitted values directly into a JavaScript string. Developers should take care to always escape “<” and “>” and “&” when generating pages on the server side.
The correct html should be:
|
1 2 3 |
<script> var test = "</script><script>alert('injection attack');</script>"; </script> |
After all the advancements there have been in browsers its surprising to still run into these kinds of things.