How to execute Javascript inside jQuery selector

Question

I have a code like this:

$('.' + InjectionPoint).removeClass('classname');

where InjectionPoint is the part controlled by end user, apparently this code is vulnerable to DOM XSS, but is it really exploitable? and how should an attack vector be like?

Thanks

Community · Accepted Answer · 2017-05-23 11:52:18Z

4

On what are you basing your belief that "this code is vulnerable to DOM XSS"?

Based on this answer, that was true in older versions of jQuery, but not any version later than 1.6.3: https://stackoverflow.com/a/11170073/877682

edited May 23, 2017 at 11:52

CommunityBot

11 silver badge

answered Dec 19, 2015 at 6:24

Aaron

2,2374 gold badges31 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

ksr Over a year ago

It was a web security scanner that reported that issue, but I think you are right that it's not exploitable, but aren't there a way to evaluate expressions inside the selector, even just for development purposes

Tyler · Accepted Answer · 2015-12-19 06:28:21Z

0

This is definitely subject to XSS. Check out this article which describes how an attacker might go about it: https://ttmm.io/tech/jquery-xss/

Basically, the author recommends that you use document.querySelectorAll() instead of the jQuery selector function. Someone commented that this is a non-issue for jQuery 1.7 and above but don't quote me on that.

In general, it's never ever a good idea to trust what your users give you.

answered Dec 19, 2015 at 6:28

Tyler

516 bronze badges

Collectives™ on Stack Overflow

How to execute Javascript inside jQuery selector

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related