如何执行<script> tag coming in AJAX call, without making any change in client side JS

Question

[
    {
        "Book ID": "1",
        "Book Name": "UNIX **<script type='text/javascript'>alert('test')</script>**",
        "Category": "Computers",
        "Price": "113"
    }, 
    {
        "Book ID": "2",
        "Book Name": "Book two",
        "Category": "Programming",
        "Price": "562"
    }
]

This is the JSON I am sending via API I am sharing with multiple people. When I parse the JSON using JavaScript, <script> tag is not executed. What are the modification should I make in the JS injected into JSON so that <script> tag will be executed without doing any extra work at client side JS. Is it possible?

Answer 1

It is not possible.

If the techniques you are using to insert that code into the document do not trigger the JS, than changing what you are inserting won't fix that.

Answer 2

You have two options:

Find a flaw in the client page and exploit it, for example, if the client js get's the API answer and prints it in a <label> tag unsanitized, you could send something like </label><script>alert(1)</script><label> so your script would close the label, inject your script and open it again.

Or you could do a minimal modification in clientside and get the object from API as this:

{
    "Book ID": "1",
    "Book Name": "UNIX",
    "script": "alert('test')",
    "Category": "Computers",
    "Price": "113"
},

And then, in clientside run it with:

Function(obj.script)();