Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

.setinterval and XSS

In the OWASP XSS prevention cheat sheet it says that untrusted data cannot be safely put inside the .setinterval JS function. Even if escaped/encoded, XSS is still possible.

But if I have something like this:

setInterval(function(){ alert('<%=UNTRUSTED_DATA%>'); }, 3000);

And if I JS encode "UNTRUSTED_DATA", how would XSS be possible?

like image 283
pineappleman Avatar asked Jun 08 '15 20:06

pineappleman


1 Answers

There is an overload of setInterval that accepts a string of code instead of a function, which is basically exec on an interval.

I believe that is what the OWASP cheat sheet is referring to, you can put untrusted strings in that overload. You are using the function overload, which is not the one OWASP is calling out.

like image 173
vcsjones Avatar answered Nov 03 '22 01:11

vcsjones