JavaScript 中的 XSS 漏洞

Question

Fortify showing XSS vulnerability for following code on document.write

for (var i in this.links)
{
 if (i == this.links.length - 1)
 {
   document.write(((i == 0) ? "" : " | ") + this.text[i]);
 }
 else
 {
   document.write(((i == 0) ? "" : " | ") + "<a href='" + this.links[i] + "'>" + this.text[i] + "</a>");
 }
} 

Answer 1

You need to sanitize your data before you use document.write. Also, since you're inserting HTML into the DOM you are opening yourself up for DOM XSS Attacks.

I advise you to read this on how to prevent XSS and this to prevent DOM based XSS attacks