Base de connaissances en sécurité
Découvrez les vulnérabilités de sécurité web et comment les prévenir
Types de vulnérabilités
Cross-Site Scripting Guide
DOM-based Cross-Site Scripting (XSS)
DOM-based XSS occurs when user input is processed by client-side JavaScript and written to the DOM without proper validation or encoding.
High Risque
A03:2021 – Injection
CWE-79: Cross-site Scripting
Impact sur la sécurité
Impact potentiel
Execute arbitrary JavaScript code in victim's browser
Steal session cookies and authentication tokens
Perform actions on behalf of the victim
Redirect users to malicious websites
Modify page content to display false information
Méthodes de prévention
Prévention
Validate and sanitize all user inputs on both client and server side
Use textContent instead of innerHTML when possible
Implement Content Security Policy (CSP) headers
Encode special characters before inserting into DOM
Use modern frameworks with built-in XSS protection
Exemples de code
Exemples d'implémentation
javascript⚠️ VULNERABLE
// VULNERABLE - Direct DOM manipulation
const userInput = new URLSearchParams(location.search).get('name');
document.getElementById('welcome').innerHTML = 'Hello ' + userInput;
// VULNERABLE - Using eval with user data
const userData = location.hash.substring(1);
eval(userData);Cas réels
Incidents de sécurité notables
Facebook Messenger XSS via file upload (2016)
Google Search XSS through URL parameters (2015)
Twitter XSS via tweet composition (2014)
YouTube XSS through video descriptions (2013)