search

cure53 / jPurify

jPurify
Mozilla Public License 2.0
64 stars 11 forks source link

Enumerate and test against all jQuery XSS sinks #1

Closed cure53 closed 9 years ago

cure53 commented 9 years ago 
for((i)in(jQuery.fn)){try{$('body')[i]('<svg onload="alert(\''+i+'\')">')}catch(e){}}

This fairly trivial snippet, once run on jquery.com or any other "jQueryfied" website, shows a good overview on easy to find, active XSS sinks.

We should protect against all of these. Further, additional sinks need to be identified (passive, 2nd and nth arguments, function-only argument, wrapped object arguments).

cure53 commented 9 years ago

This also holds for older versions...