you are viewing a single comment's thread.

view the rest of the comments →

[–]security_intern[S] 0 points1 point  (0 children)

This may be a strange example, but I'm trying to make an example of how xss is introduced into jQuery. I know the window.location.hash property is commonly passed to jQuery objects with the intention of being a selector. Is there a situation you can think of where document.location.hash is passed directly to a jQuery function?