.setinterval and XSS

Question

In the OWASP XSS prevention cheat sheet it says that untrusted data cannot be safely put inside the .setinterval JS function. Even if escaped/encoded, XSS is still possible.

But if I have something like this:

setInterval(function(){ alert('<%=UNTRUSTED_DATA%>'); }, 3000);

And if I JS encode "UNTRUSTED_DATA", how would XSS be possible?

Answer 1

There is an overload of setInterval that accepts a string of code instead of a function, which is basically exec on an interval.

I believe that is what the OWASP cheat sheet is referring to, you can put untrusted strings in that overload. You are using the function overload, which is not the one OWASP is calling out.