Skip to content

Instantly share code, notes, and snippets.

@azu

azu/javascript-protocol-XSS.md

Last active May 25, 2023 00:12
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save azu/5dbbe70c27c2cdcd9872c5740fc7331d to your computer and use it in GitHub Desktop.
Save azu/5dbbe70c27c2cdcd9872c5740fc7331d to your computer and use it in GitHub Desktop.
Download ZIP
<a href=javascript:alert(1) traget=_blank>XSS</a> behavior in modern browser.
Raw
javascript-protocol-XSS.md

Almost browsers prevent to XSS that is using javascript: protocol.

<a href=javascript:alert(location.origin) traget=_blank>XSS</a>

Demo: https://nuvjcp.csb.app/

Summary

Brower Work? Detail
Chrome No about:blank#blocked
Microsoft Edge(Chromium) No about:blank#blocked
Firefox Yes location.origin is null. It is safe.
Safari No
Mobile Safari No Show warning dialog
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment