search

resource / Front-End-Standards

Front-end development standards for Resource.
MIT License
23 stars 1 forks source link

XSS #23

Open lkrids opened 11 years ago

lkrids commented 11 years ago

https://github.com/LukeAskew/Front-End-Standards/blob/master/JavaScript/Security.md -- the hash is just a string, it never gets evaled or inserted in dom. Does that allow xss?

LukeAskew commented 11 years ago

You are correct.

I pulled this snippet from an issue we had on an HP site. There was some additional AJAX things happening as well. I will work to complete the example.