=_= 在 javascript 或 html 中是什么意思？

Question

When i'm reading XSS cheat sheet , i notice a special usage i have never seen

<img src="/" =_=" title="onerror='prompt(1)'">

What does "=_=" means? it's below the sentense "On Mouse Over". I guess it mean mouse over handler? And it cause xss in this case. But it all by guess. Anyone can help me?

Answer 1

It's just an attribute on the element. It doesn't have any meaning by itself, so it may be present simply as a red herring.

Prettified, the code is:

<img
  src="/"
  =_=" title="
  onerror='prompt(1)'"
>

In HTML, = in an attribute specifies the delimiter between the attribute name and the attribute value, so it's:

=_=" title="
^^ attribute name

=_=" title="
  ^ delimiter between attribute name and attribute value

=_=" title="
   ^ attribute value contents delimiter

=_=" title="
    ^^^^^^^ attribute value

=_=" title="
           ^ attribute value contents delimiter

And you could retrieve the attribute value if you wanted.

 const img = document.querySelector('img'); console.log(img.getAttribute('=_'));

 <img src="/" =_=" title=" onerror='prompt(1)'" >

Note that the attribute name is =_ , not =_= - the final = is the delimiter, not part of the attribute name.

The "XSS" is caused only by the src and the onerror , not by anything else. Wherever you're encountering this, the =_ probably doesn't do anything at all. It could , but it probably doesn't.

 <img src="/" onerror='prompt(1)'">