Is xss attack possible between html tag while < and > are encoded? for example:
<tag>{{output}}</tag>
if "<", ">" in {{output}} are encoded into "<", ">", and <tag> cannot be <script>, can xss happen?
3
votes
1 Answers
4
votes
Firstly, it needs to be said that manually implementing your own XSS filters is almost always a terrible idea..
They are generally very easy to evade, especially by encoding payloads (for example, < can be URL encoded as %60, etc). It's far safer (and preferable) to use native escape functions provided by your platform whenever possible. For example, htmlspecialchars in PHP, html.escape in Python, and so on.
In your specific example, XSS is not possible with < or > because your output is inserted between tags and not within them (such as in an attribute value). Your original filter would not protect against XSS in other scenarios such as:
<img src="{{output}}">
Inserting a value of " onerror="alert(1) would result in this XSS:
<img src="" onerror="alert(1)">
Please do not implement your own filters if you can help it. Here is some OWASP documentation:
