.setinterval and XSS

被刻印的时光 ゝ 提交于 2020-07-18 17:15:01

问题


In the OWASP XSS prevention cheat sheet it says that untrusted data cannot be safely put inside the .setinterval JS function. Even if escaped/encoded, XSS is still possible.

But if I have something like this:

setInterval(function(){ alert('<%=UNTRUSTED_DATA%>'); }, 3000);

And if I JS encode "UNTRUSTED_DATA", how would XSS be possible?


回答1:


There is an overload of setInterval that accepts a string of code instead of a function, which is basically exec on an interval.

I believe that is what the OWASP cheat sheet is referring to, you can put untrusted strings in that overload. You are using the function overload, which is not the one OWASP is calling out.



来源:https://stackoverflow.com/questions/30718230/setinterval-and-xss

标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!