Default payload edge-case about ezxss HOT 5 CLOSED

Hey @Geluchat,

Thanks for this. Do you maybe have an example of a website where this is not triggered?

Do you mean that some sites never trigger it, or do you mean that the page might be closed before being completely loaded? Or is there some kind or error involved that the page is not 'loaded'?

Hope to hear from you.

from ezxss.

Because it might be even better to change "complete" to "loading" or "interactive". But it needs some debugging.

from ezxss.

Hello,

To illustrate, when a website utilizes document.write(XSS), the document remains in a loaded state. The MDN documentation provides insight into this concern. You can refer to the relevant section here: MDN's Document.write. To quote: "document.write() writes to the document stream, and invoking document.write() on an already loaded document implicitly triggers document.open(), resulting in the clearing of the document."

Below is a code snippet that demonstrates the issue:

document.write('<script src="//PAYLOAD"></script>')

Best regards,

from ezxss.

Thanks! I will look into this, do some debugging and will fix accordantly.

from ezxss.

Fixed in d06f862

from ezxss.