Hacker News Reader

There's an XSS on the page:

Try to login or create an account. Enter this as your username (or password, as long as it's not valid: you need an error), hit submit. Error + XSS.

</script><script>alert(1);</script>

You escape quotes, which is good, so I can't break out of the JSON request. But you have to remember how the HTML parsing of a page works. </script> will break out from within a javascript string.

View on HN

I know this is off-topic, but you can use eval(String.fromCharCode(XX, XX, XX, etc)) to run arbitrary JavaScript, even if quotes are escaped.

That's not the reason why people escape quotes.

Imagine the case where he had not escaped quotes, but had escaped < and >. In that case, I could put a doublequote/singlequote to break out of the JSON. Then I could just put whatever javascript I wanted and run it.

But that is true, trying to filter specific character sequences for example, "eval" is never a good idea.

Reply on news.ycombinator.com