OWASP Periodic Table of Vulnerabilities - Cross-Site Scripting (XSS) - DOM-Based

Return to Periodic Table Working View

Root Cause Summary

Client-side code (e.g. JavaScript) inserts attacker-controlled data into the DOM in a way that allows the data to be executed as functional code. Examples include using document.write, which can introduce SCRIPT nodes directly, and modifying innerHTML or other element attributes that can cause SCRIPT nodes to be generated or function definitions to be overwritten. DOM-Based XSS differs from other forms of cross-site scripting which are the result of vulnerable server-side code.

Browser / Standards Solution

None

Perimeter Solution

None

Generic Framework Solution

"Web 2.0" frameworks must expose an API for page creation/modification that does not use document.write/ln or allow dynamic data to be injected into innerHTML or similar DOM element attributes. Dynamic data must be written to the DOM by using createTextNode, which does not introduce the danger of interpreting user data as functional code.

Custom Framework Solution

None

Custom Code Solution

None

Discussion / Controversy

DOM-Based Cross-Site Scripting is Sometimes referred to as “Type-0 XSS”.

References

OWASP - DOM Based XSS

DOM-based XSS

WASC - DOM Based Cross Site Scripting or XSS of the Third Kind

DOM based Cross-site Scripting vulnerabilities