4 ms·
Is this a twitter-only problem with the way the URLs are formed? Or is this a common way of injecting JS into links on other sites as well?
by theycallmemorty 16y ago
Is this a twitter-only problem with the way the URLs are formed? Or is this a common way of injecting JS into links on other sites as well?
- jasondavies 16y agoIt's caused by Twitter's insufficient escaping of URLs, specifically a rogue quotation mark character can be injected after the @ symbol and thus you end up with something like <a href="URL@" onmouseover="insert XSS attack here">...</a> So this attack won't work on other sites that escape URLs properly.