Cross-site scripting – Stored XSS into anchor href attribute with double quotes HTML-encoded | PortSwigger Lab Note #2

target：

• Lab URL:
  
  

  
  
  

  3.Inject a payload such as javascript:alert(1) into the href attribute to trigger the XSS.

  
  
  

  

  
  
  

  
  
  
  Remediation：
  

  
  
  

  The application should implement proper context-aware output encoding to prevent user-supplied data from being interpreted as executable code. All inputs must be safely encoded before being rendered in the browser.

  
  
  

  Additionally, input validation should be enforced to block dangerous patterns such as "javascript:" URLs. The use of secure frameworks with built-in XSS protection and the implementation of a Content Security Policy (CSP) are recommended to further reduce risk.

  
  
  

  
  
  
  Lessons Learned：
  

  
  
  

  This lab shows that XSS can occur in attribute contexts such as href, even when double quotes are HTML-encoded. By analyzing where user input is placed in the HTML structure, attackers can craft context-specific payloads like javascript: URLs to trigger execution. Proper defenses should include context-aware output encoding and validation of dangerous URI schemes.

  Vollständiger Original-Bericht

  Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.

  ↗ Original-Artikel auf dev.to lesen