DevelopSec: Developing Security Awareness · Jardine Software Inc.

Ep. 81: JavaScript in HREF and SRC (XSS)

·20 min·2 clips

James Jardine explains how Hurricane Irma delayed this episode on JavaScript XSS vulnerabilities.

This episode focuses on the security risks of placing JavaScript code directly within HTML HREF and SRC attributes. Host James Jardine, a security expert and founder of Jardine Software, explains how this common practice can lead to cross-site scripting vulnerabilities. He recorded this episode after a delay caused by Hurricane Irma, and a corresponding blog post is already available. Jardine details how attackers can inject malicious scripts using the `javascript:` protocol in an HREF attribute, such as in a link tag. He explains that the SRC attribute in tags like `<iframe>` or `<script>` can also be exploited with JavaScript URIs. The host clarifies that while modern browsers have implemented some security controls, many older techniques still pose a threat. He describes specific attack vectors, including user-controlled input that is improperly reflected into these attributes without encoding. Jardine emphasizes that developers often mistakenly believe sanitizing quotes is sufficient, but this method fails against `javascript:` injections. The discussion covers how HTML encoding does not neutralize a `javascript:` URI placed inside an HREF. He notes that frameworks and libraries sometimes inadvertently promote this risky pattern through their documentation or features. A key insight is that the `javascript:` protocol executes in the context of the current page, allowing theft of cookies or session data. Jardine points out that even with Content Security Policy headers, legacy codebases may remain vulnerable if this pattern exists. He finds it surprising how frequently this issue appears in both custom code and third-party web components. The host stresses that validation focusing solely on HTML tags and events misses this specific attack vector. A memorable moment involves explaining how a simple link, seemingly harmless, can trigger a complex malicious payload. Jardine advises that the most effective mitigation is to avoid using `javascript:` URIs altogether in favor of safer event handlers. The tone is educational and conversational, delivered as a solo commentary from an experienced practitioner. The style is technical and direct, focusing on clear examples and actionable advice for developers. Web application developers and security engineers seeking to understand classic XSS vectors would benefit from this episode. Listeners looking for high-level security policy discussions or non-technical narratives might find the content too specialized.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from DevelopSec: Developing Security Awareness