正确使用 appendChild 避免 XSS

Question

After doing an XXS site check, one error that pops up in the console is the inline use of the scripts needed for Google Analytics Tag Manager. I have now created an external analytics.js file, which I load in the header and created an IIFE to load the script, then checked that it works in GA (it does):

var load_google_tag_manager = function(){
    var script = document.createElement("script");
    var head = document.getElementsByTagName('head')[0];
    script.async = true;
    script.type = "text/javascript";
    script.src = "https://www.googletagmanager.com/gtag/js?id=UA-XXXXXX-1";
    head.appendChild(script);
}();

window.dataLayer = window.dataLayer || [];

function gtag() {
    dataLayer.push(arguments);
}
gtag('js', new Date());
gtag('config', 'UA-XXXXXX-1', {
    "anonymize_ip": true,
    "allow_display_features": false,
    "link_attribution": false
});

I then checked the console again for error warnings and got one, this was the use of the function appendChild . After reading some OWASP documentation , I understand that using this can be potentially dangerous, and some good examples of how to make it safer are given, such as: how to use the setAttribute method. eg:

SAFE and FUNCTIONALLY CORRECT example

 var x = document.createElement("input");
 x.setAttribute("name", "company_name");
 x.setAttribute("value", '<%=Encoder.encodeForJS(companyName)%>');
 var form1 = document.forms[0];
 form1.appendChild(x);

But it does not say how to do this when you are eg not using this method. How would I eg set the src value safely? Ultimately, I want to make my IIFE safe from XXS.

Answer 1

The encoding is needed in the example because of the mixing of server-side templating with client-side code. The quotes need to be escaped to prevent the string literal from being closed, and more code added after it.

So if companyName were '); alert(1);// '); alert(1);// , then:

x.setAttribute("value", '<%=companyName%>');

would become:

x.setAttribute("value", ''); alert(1);//');

Your URL looks like a fixed constant, so there is no possibility of something like this, so your code should be fine as it is.