Random seed may result in valid attribute
gbrindisi opened this issue · 2 comments
gbrindisi commented
The randoms generated seed for the taint may result as a valid html attribute like href, src, etc.
https://github.com/gbrindisi/xsssniper/blob/master/core/payload.py#L14
Must blacklist common attributes names.
fgeek commented
Wouldn't it be better just to use long enough randoms so that it won't overlap with anything existing?
gbrindisi commented
Yes but since I've left the chance to set the seed length to the user, this problem could still occur.
If you have better ideas I'd like to hear them!