16

Example:

if($('#' + untrusted_js_code).length) > 0
  ....`

Normally "untrusted_js_code" should be a simple string representing the ID of an item. The value of the variable comes from an iframe (trough postMessage), this is why it's untrusted. And I'm just checking if that item exists in the current page, and only then do stuff with it.

4
  • As maximum it might cause a syntax error if untrusted_js_code equals e.g. "[some thing]".
    – VisioN
    Commented Jun 23, 2012 at 13:39
  • 5
    Why use untrusted input at such a position? Anyway, if you want to be 100% safe use document.getElementById() instead of a library function as powerful as $() Commented Jun 23, 2012 at 13:39
  • @ThiefMaster I've taken look at the source code of jQuery and as far as I can tell selectors should actually be safe (no evals whatsoever that I can see anyway)
    – Mahn
    Commented Jun 23, 2012 at 13:54
  • Yes, but if you could somehow manage to get the function to run its create a DOM element part instead of the find elements by selector part you could create e.g. an image with an onload script. Commented Jun 23, 2012 at 13:57

4 Answers 4

14

As of 22/10/2012, jQuery 1.8.2:

Yes, XSS attacks are possible.

var input = "<script>alert('hello');</script>"
$(input).appendTo("body");

See demo. It seems the jQuery team has acknowledged this and has plans to address it in jQuery 1.9.

As of jQuery 1.8, use $.parseHTML if you expect user input to be html:

var input = "<script>alert('hello');</script>"
$($.parseHTML(input)).appendTo("body");​

See demo, no alerts.


In the case OP describes however, the following:

var untrusted_js_code = 'alert("moo")';
$('#' + untrusted_js_code).show();

Will translate to this:

$('#alert("moo")').show();

This is intrepreted by jQuery as a CSS selector, thanks to the preceding # in the string, which as oppposed to html cannot have in-line JS code, so it is relatively safe. The code above would only tell jQuery to look for a DOM element by that ID, resulting in jQuery failing to find the element and thus not performing any action.

5
  • I think it was possible to inject scripts (via HTML containing inline events) in older versions though. But maybe I'm confusing that bug with something similar.. Commented Jun 23, 2012 at 13:38
  • @ThiefMaster you're correct. Versions prior to 1.6.3 are susceptible to some XSS bugs that could trick jQuery into evaluating the HTML rather than selecting a DOM element. ma.la/jquery_xss
    – Yahel
    Commented Jun 24, 2012 at 18:55
  • var untrusted_js_code = '<img src="no-such-.gif" onerror="alert()">'; jQuery( '#' + untrusted_js_code).appendTo("body");; that code alerts out on jQuery<1.6.3
    – Yahel
    Commented Jun 24, 2012 at 18:58
  • Yeah, balpha has pointed this out in another answer to this question; I have added a link to his answer here just in case.
    – Mahn
    Commented Jun 24, 2012 at 22:44
  • Updated again. Turns out jQuery 1.8.2 is still vulnerable, odd how we missed that.
    – Mahn
    Commented Oct 22, 2012 at 1:34
8

Yes, if you're using an older version of jQuery, this is possible in certain cases. This was fixed (here's the commit) in version 1.6.3. Also see the corresponding bug report.

The commit includes a test case that clarifies the issue:

jQuery( '#<img id="check9521" src="no-such-.gif"' +
        'onerror="jQuery._check9521(false)">' ).appendTo("#qunit-fixture");

With jQuery versions prior to 1.6.3, the onerror code would have been executed.

Your particular example (just checking for the length) doesn't have this issue, though.

0
2

With that statement, you're asking jQuery to perform a query based on a selector. Being the string a selector, it can't do any harm.

2

It's not as clear as others are saying. The untrusted code won't be able to do XSS (as long as you have a sufficiently new version of jQuery, as balpha points out), but it can hang the user's browser or make your code receive unexpected input.

For example, if untrusted_js_code was :input, the translation would be:

$("#:input")

and jQuery seems to just ignore the # and match on :input. Seriously, open a console and run that bit of code on this page. (This appears to only work with pseudoclasses.)

A nefarious party could give you a computationally intensive selector (very simplistically :not(.asdf):not(.asdf) tens of thousands of times) which takes seconds (or minutes...) to process.

(Also, there is the possibility of browser bugs, so a selector might be able to be constructed to crash the users web browser.)

2
  • yes, but we are talking about the same user who sends the contents of that variable. So he can crash his browsers as many times as he wants ,I don't care:)
    – thelolcat
    Commented Jun 23, 2012 at 14:07
  • 2
    It's a fair point though, in the most common case scenario the user will only be able to crash his own browser, but it can be problematic if you were to store the ID or send it to some other users.
    – Mahn
    Commented Jun 23, 2012 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.