Some of the dangerous links in jquery use that can be alerted by XSS attacks _jquery

$
we often select or generate DOM elements by passing in a string to $, but this is risky if the string is from user input.

First look at a demo:http://jsbin.com/duwuzonife/1/edit?html,js,output

$ (" ");

When the user enters a string that is like this, although the element is not immediately inserted into the DOM of the Web page, the DOM element has been created and is in memory. For the element, as long as its SRC attribute is set, the browser immediately requests the resource that the SRC attribute points to. We can also use this feature to do the pre-loading of pictures. In the example code above, while creating the element, it also sets its properties, including the SRC attribute and the OnError event listener, so the browser immediately requests the image resource, apparently not, and randomly triggers the onerror callback function and executes the JavaScript code.

Recommended reading of the official document $: http://api.jquery.com/jQuery/

Other methods similar to

. After ()
. Append (). Appendto ().
before ()
. html ().
InsertAfter ().
insertbefore (
) . prepend (). Prependto (). ReplaceAll ().
replacewith (
)
.
Unwrap (). Wrap (). Wrapall ( )
. Wrapinner ().
prepend ()

These methods not only create DOM elements, but are immediately inserted into the page's Dom tree. If you insert the inline JS using the <script> tag, it will be executed immediately.

Unsafe input sources

Document. URL *
document.location.pathname *
document.location.href *
document.location.search
* Document.location.hash
document.referrer *
window.name
Document.cookie

Most of the document's properties can be accessed through the Global Window object. The addition of * property returns the time code (UrlEncode) after the string, which requires decoding before it can pose a threat.

Unsafe operation
the use of strings that can be edited by the user is hidden in the following scenarios. In general, any manipulation of strings as executable code is unsafe.

1. Creating a function from a string

(1) Eval
(2) New Function
(3) Settimeout/setinterval
2. Jump Page

Location.replace/location.assign
Modify the src attribute of the <script> label
Modifying event listeners
Summary
If a DOM-XSS attack occurs when using JQuery, it is mostly due to the neglect of two things:
1. When giving the $ pass parameter, the control of the source of the parameter.
2. The user's input path is not only the form, but also the address bar, can also modify the DOM directly through the developer tools, or execute the JS code directly in the console.