I'm writing a script that needs to write the current page location to the DOM, and I'm concerned about XSS. Is the following Javascript snippet safe from XSS?

var script = document.createElement('script');
script.setAttribute('src', '=' + encodeURIComponent(document.location.href));
document.getElementsByTagName('head')[0].appendChild(script);

I know that using document.write() to acplish the same thing is not safe in various browsers, but I've not seen any source discussing if using the DOM access methods is.

I'm writing a script that needs to write the current page location to the DOM, and I'm concerned about XSS. Is the following Javascript snippet safe from XSS?

var script = document.createElement('script');
script.setAttribute('src', 'http://fake.?src=' + encodeURIComponent(document.location.href));
document.getElementsByTagName('head')[0].appendChild(script);

I know that using document.write() to acplish the same thing is not safe in various browsers, but I've not seen any source discussing if using the DOM access methods is.

• javascript
• security
• xss

Share Improve this question Follow asked Dec 3, 2010 at 22:47 Benjamin AndersonBenjamin Anderson 4311 silver badge33 bronze badges

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 8

There's no need to use "setAttribute":

script.src = 'http://fake.?src=' + encodeURIComponent(document.location.href);

I don't see where an XSS vulnerability would sneak in here. The server code at "fake." has to be "hardened" against weird values of that "src" parameter, I suppose, but that's going to be true no matter what your Javascript looks like.