Avoid setting an event handler like onclick, onmouseover, onsubmit... using element.setAttribute() (Javascript) | CAST Appmarq
Avoid setting an event handler like onclick, onmouseover, onsubmit... using element.setAttribute() (Javascript)
CRITICAL
Rule Definition
Imagine your code takes a username from a URL parameter to customize a button.
// User-controlled input
let untrustedUsername = new URLSearchParams(window.location.search).get('username');
let myButton = document.getElementById('myButton');
// DANGEROUS: The string is treated as code
myButton.setAttribute('onclick', `alert('Hello, ${untrustedUsername}')`);
If a user provides a normal username like Alice, the attribute becomes onclick="alert('Hello, Alice')", which is fine.
However, an attacker can provide a malicious string like: Alice'); alert(document.cookie); //
The resulting HTML attribute becomes:
When any user clicks this button, the browser will execute both alerts, stealing the user's cookie. The attacker successfully injected and executed arbitrary JavaScript.
Remediation
Ensure you don't set an event handler using element.setAttribute(), prefer using addEventListener().
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.
Benchmark Statistics
Global Compliance
nan%
Total Violations
0
Total Opportunities
0
Average Violations / App.
nan
The compliance score represents 1 minus the ratio between the number of times a rule has been violated compared to the number of opportunities in a set of applications that the rule could have been violated.