0

Data is read from window.location and passed to the wrap() function of function of jQuery via the following statement:

t.Location.wrap(window.location)

The version of jQuery in use is the 1.12.1 - Is this code vulnerable to DOM based XSS?

Joe
  • 2,734
  • 2
  • 12
  • 22
John Flow
  • 1
  • 1
  • Difficult to tell when we don't know what `t.Location` is. Would you be willing to add more context and detail to your question? – EdOverflow Feb 04 '19 at 16:37
  • try it with a script tag. if it calls `.html()` internally, it's likely vulnerable. – dandavis Feb 04 '19 at 21:54

0 Answers0