Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with javascript
Search options not deleted
user 5400
The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
0
votes
Should including an external webpage in PHP be dangerous in principle?
It looks like you're just trying to display HTML and JavaScript content from a remote source. You should not use require() or include() for this. …
- 135k
3
votes
Accepted
Hide XSS payload
To answer your three questions:
Fixing the properly escaped output:
Make your XSS patch the DOM so that the JavaScript you inject is removed from that particular tag. …
- 135k
1
vote
Accepted
Could this code be vulnerable to XSS?
However, if the javascript on the page was to pass location.href through the decodeURI function first, i.e. writing decodeURI(location.href), it would be vulnerable. …
- 135k
3
votes
XSS and Content Security Policy
This applies to:
JavaScript
CSS
Fonts (e.g. WOFF)
Ajax (XmlHttpRequest and similar)
WebSockets
Video
Objects (e.g. … You can do the same thing with path relative JavaScript imports. The fix here is to always reference content by its full canonical path. …
- 135k
2
votes
Accepted
Are there risks in user-uploaded .txt files sent as a string to PHP
Anything you do on the client-side can be ignored by an attacker. They don't even need to visit your web page in order to send requests to the PHP script - they can send those requests directly with w …
- 135k
23
votes
Accepted
What security risks does Firefox 19's built-in PDF reader (pdf.js) bring?
Bypassing content escaping so that arbitrary JavaScript can be executed in the context of the PDF. Again a lot of the significance of this is related to origin policies. … Since most of the engine seems to be based in JavaScript, I'm unsure as to how likely this is. …
- 135k
5
votes
Accepted
How to verify that a clientside-generated object is genuine?
You can't prove it, no. It's on the client machine, so any code or data you hand them is theirs to change. At best you can make it difficult, with obfuscation and DRM techniques, but that's likely to …
- 135k
16
votes
Accepted
Is it possible to make an xss with only html tags
Of course, a better attack would involve destroying the div as soon as the JavaScript is called, in order to make it look legitimate.
You should escape all output in order to avoid this. …
- 135k
23
votes
Cross Site Scripting without special chars
This gives you full arbitrary JavaScript injection.
OK, so you say we can't use an equals sign. … From there you can launch JavaScript:
body {
background-image: url('javascript:alert(document.cookie);')
}
There are also other tricks you can use to gain JavaScript execution from CSS. …
- 135k
9
votes
Accepted
Is this code harmful? Why?
The code doesn't look particularly malicious - it's some kind of ad injection / tracking. It almost certainly isn't trying to hit you with browser 0-days or steal your banking credentials. However, th …
- 135k
19
votes
JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible?
Javascript parsing of JSON via eval() is considered a security vulnerability.
Modern browsers have support for proper native JSON parsing, via JSON.parse() and JSON.stringify(). …
- 135k
1
vote
Is Content Security Policy only enforced during initial rendering?
The fact that you did it with JavaScript is mostly irrelevant here.
By disabling CSP's key protection features, you removed all protection against XSS, then got XSS. …
- 135k
3
votes
Is eval() in JavaScript considered self-XSS?
Self-XSS means XSS'ing yourself by running things in console, or stored XSS in an area that only affects the user that injected the XSS. Based on your comments it sounds like you've found self-XSS, si …
- 135k
2
votes
XSS alert not working with concatenated string
You put a quote in the original one. This messes up the HTML parser because " has special meaning inside the attribute space of a tag.
I'm wrong. It's the space.
- 135k
6
votes
Accepted
Why do I get AV alerts when browsing a web page?
JavaScript can be used to exploit browser vulnerabilities, or plugin vulnerabilities (e.g. Flash / PDF) and can result in native shellcode being executed on your machine. … If you think you're actually browsing your bank's website, and your AV pops up warning you about some JavaScript exploit, you're likely to double-check that you are indeed on your bank's website, and not …
- 135k