[Solved] How to fix XSS vulnerabilites in javascript files [closed]

by


If the data is coming from the user and it’s not properly sanitized, both "<div class="column-title " + items[bucket][itemsNo - 1][1] + "">" and "<span>" + bucket + "</span>" are potential XSS attack vectors because the attacker can just insert any HTML they want, including script tags.

You can rewrite the code so that it doesn’t build the HTML by concatenating strings (which is a bad idea in general, not only from security standpoint.)

$el = $("<div class="dashboard-column"><i class="fa fa-caret-right"></i></div>");
$div = $("<div class="column-title">").addClass( items[bucket][itemsNo - 1][1] ).appendTo( $el );
$span = $("<span>").text(bucket).appendTo($div);
$div.append("<i class="fa fa-caret-right caret-right"></i><i class="fa fa-caret-down"></i>");

1

solved How to fix XSS vulnerabilites in javascript files [closed]