Can you spot the vulnerability? #16022023 - Intigriti
Given Code Snippet:
Code review:
easy-eval.js
easy-xss.js
index.html
The Vulnerability
User input is passed in ‘name’ parameter straight to the ‘innerHTML’ so it would be rendered by browser for example inserting ‘<h1>asdf</h1>’ makes ‘asdf’ bold in browser, so ‘HTML’