Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Javascript automatically executed when copying "XSS" code.

See original GitHub issue

Describe the bug Copying the code <IFRAME SRC="javascript:alert('XSS');"></IFRAME> from anywhere in the interface causes the javascript code to be executed

To Reproduce Steps to reproduce the behavior:

Put the above code anywhere into the OWASP ZAP interface.
As above, copy the code and OWASP ZAP will show the javascript alert

Expected behavior Javascript does not execute

Screenshots

Software versions

ZAP: Observed on build 2021-08-17
Browser: Firefox 92.0

Other notes In terms of security, this is probably a low concern. Perhaps at best, a user could be tricked into copying this code off a target site and the target could then “attack” the user back.

Issue Analytics

State:
Created 2 years ago
Comments:11 (7 by maintainers)

Top GitHub Comments

1reaction

thc202commented, Sep 22, 2021

Yes, this should be reported to Webswing.

1reaction

ostracizecommented, Sep 22, 2021

Good point. Perhaps an issue with Webswing itself? At any rate, it is likely triggered when ZAP prompts the user to confirm the copy to the host machine: The dialogue is not sanitizing the input. Just seems to be an annoyance.

Top Results From Across the Web

A Pentester's Guide to Cross-Site Scripting (XSS) - Cobalt.io

Examine a common security vulnerability, Cross-Site Scripting (XSS). ... The browser then executes the code because it came from a “trusted” server.

XSS (Cross-Site Scripting) Attacks and Prevention

An in-depth explanation of XSS (Cross-Site Scripting) vulnerabilities and practical steps for avoiding them.

XSS (Cross Site Scripting) - HackTricks

When trying to exploit a XSS the first thing you need to know if where is your input being reflected. Depending on the...

What is Cross-Site Scripting? XSS Cheat Sheet - Veracode

Cross-site scripting attacks, also called XSS attacks, are a type of injection attack that injects malicious code into otherwise safe websites. An attacker...

List of XSS payloads with automatic Javascript/etc. execution?

As you can see in the title, I'm looking for a list of payloads/injections, which lead to automatic code (js mainly) execution.