OWASP mentions the following example of code vulnerable to a DOM based XSS attack:
Select your language:
<select><script>
document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");
document.write("<OPTION value=2>English</OPTION>");
</script></select>
And they say it can be attacked with the following URL:
http://www.some.site/page.html?default=<script>alert(document.cookie)</script>
This makes me wounder if the web browser does JavaScript evaluation twice? I.e., does it run document.write
's first and then turn the code into the output displayed below, and then run it again to execute the alert box script? How are the HTML and JavaScript parsers triggered - parallel/sequential/top down/bottom up? What's the order they follow?
Select your language:
<select>
<OPTION value=1><script>alert(document.cookie)</script></OPTION>
<OPTION value=2>English</OPTION>
</select>