On: JQuery magicpreview plug-in

[adamc]

This plugin is vulnerable to XSS -- try entering <script>alert('boom');</script> in the input field of the example.

[riklomas → adamc]

You can use the options to set the output as text() rather than html(), e.g. $('div').magicpreview('mp_', { 'change': 'text' });

But yes, I should really add a flag to strip out any script elements :)

[robertk → riklomas]

XSS detection is not just as simple as that. For example, in IE, entering the following produces a pop-up:

   <table style="background-image:url(javascript:alert(1))"><tr><td>Hi</td></tr></table>

However, read debt's comment below. XSS is irrelevant here since "XSS" means cross-site scripting, i.e., ,managing to embed Javascript into pages someone ELSE sees. Only the client sees this, it doesn't get reproduced for anyone else.

[debt → adamc]

This is only on the front end. If the backend filters html tags then XSS won't be a problem.

[adamc → debt]

Filtering tags is notoriously difficult, though, because of the variety of encodings possible. Maybe you meant "properly encodes output"? That's the typical solution.