6

After reading this question users warned that this method of encoding html is unsafe

    return $('<div/>').html(encodedText).text();

"don't use jQuery.html().text() to decode html entities as it's unsafe because user input should never have access to the DOM "

"I suggest using a safer, more optimized function"

The purpose of this method is to take encoded input i.e Fish &amp; chips and produce unencoded output i.e Fish & Chips

So as I understand it, they claim that for some value of encodedText, that javascript can be executed. I tried to reproduce this setting encodedText to <script>alert(1)</script> and a few other simple attacks and was unable to find any signs of XSS vulnerability.

My question is: is there any demonstrable xss vulnerability in any browser when using $('<div/>').html(encodedText).text()

actual_kangaroo
  • 5,971
  • 2
  • 31
  • 45

2 Answers2

8

There are plenty of ways of doing it, this is one way with onerror with an image tag. 

var x = $("<div/>").html('<img src="X" onerror="alert(\'hi\');" />').text();
console.log(x);
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
epascarello
  • 204,599
  • 20
  • 195
  • 236
1
$('<div/>').html('<img onerror="alert(0)" src=invalid>').text()
Cheers
  • 11
  • 1