Does Dom-based XSS be killed by browser nowadays?

Open liweijian opened this issue 9 years ago • 1 comments

I just tried the classic demo

<HTML>
<TITLE>Welcome!</TITLE>
Hi
<SCRIPT>
var pos=document.URL.indexOf("name=")+5;
document.write(document.URL.substring(pos,document.URL.length));
</SCRIPT>
<BR>
Welcome to our system
…
</HTML>

The testing url:

http://www.test-domain.me/welcome.html?name=SOME_SCRIPT_HERE

Would not work at this moment, since Safari, Firefox and Chrome would change the <, > to < , > by default.

Jun 03 '16 01:06 liweijian

Try name=<iframe src=javascript:alert(1)>

Aug 08 '16 13:08 albinowax