Ask a Question
Ask Question Login
Corporate Training
  1. Community
  2. Java
  3. Question
Java

What does the javascript tab character do?

Asked by Jake Edmunds Oct 6, 2022 1.3K views 1 answer
Share

About this question

 Some context: I was assigned on a pentest and found an application that let me place my own links in a tag's href attribute. As expected, all strange values like [removed] were correctly filtered by an XSS filter, however I discovered that you could bypass this filter by injecting a TAB character in the middle of the protocol specification like such:

Now what I would like to know is, why do browsers accept this as a valid javascript URL which will happily execute code whereas other characters like SPACE character are not allowed? Is there a historic reason for them allowing this strange format?

Note: Tested on Chrome, for those that like to test it, it also works with [removed] like so:

Your answer

1 Answer

More Java discussions

Learn & Explore

Free tutorials and interview questions from industry experts — learn the skill, then get ready to prove it.

Latest Java Blogs

Guides, tips and career advice on Java from JanBask experts.