Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Cross Site Scripting (DOM-BASED) Issue Logged

Amit | Last updated: Jun 17, 2020 07:37AM UTC

Burpsuite has logged Cross Site Scripting (DOM-BASED) Issue for one of our application. Following static analysis is provided, Data is read from document.location.pathname and passed to document.write() via the following statement: document.write('<base href="' + document.location.pathname.replace('index.html', '') + '" />'); Following is the code - <!DOCTYPE html><html><head><meta http-equiv="Content-Security-Policy" content="base-uri 'self'"><script>document.write('<base href="' + document.location.pathname.replace('index.html', '') + '" />');</script> <script id="FileHandle">try { if (document && document.location.pathname && document.location.pathname.toLowerCase().lastIndexOf('.html') != -1) { var sPath = document.location.pathname.toLowerCase().replace(/\/+index\.html\/*/, '/'); document.location.href = document.location.href.toLowerCase().replace(document.location.pathname, sPath); } } catch (error) { }</script> Would like to know how to fix above DOM XSS issue. Also, would like to know whether issue exists only in first line or also inside FileHandle.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.