Function get_XSS_data

examples/contrib/xss_scanner.py:339–520

Return a XSSDict if there is a XSS otherwise return None

(
    body: str | bytes, request_URL: str, injection_point: str
)

def get_XSS_data(
    body: str | bytes, request_URL: str, injection_point: str
) -> XSSData | None:
    """Return a XSSDict if there is a XSS otherwise return None"""

    def in_script(text, index, body) -> bool:
        """Whether the Numberth occurrence of the first string in the second
        string is inside a script tag"""
        paths = paths_to_text(body.decode("utf-8"), text.decode("utf-8"))
        try:
            path = paths[index]
            return "script" in path
        except IndexError:
            return False

    def in_HTML(text: bytes, index: int, body: bytes) -> bool:
        """Whether the Numberth occurrence of the first string in the second
        string is inside the HTML but not inside a script tag or part of
        a HTML attribute"""
        # if there is a < then lxml will interpret that as a tag, so only search for the stuff before it
        text = text.split(b"<")[0]
        paths = paths_to_text(body.decode("utf-8"), text.decode("utf-8"))
        try:
            path = paths[index]
            return "script" not in path
        except IndexError:
            return False

    def inject_javascript_handler(html: str) -> bool:
        """Whether you can inject a Javascript:alert(0) as a link"""

        class injectJSHandlerHTMLParser(HTMLParser):
            injectJSHandler = False

            def handle_starttag(self, tag, attrs):
                for name, value in attrs:
                    if name == "href" and value.startswith(FRONT_WALL.decode("utf-8")):
                        self.injectJSHandler = True

        parser = injectJSHandlerHTMLParser()
        parser.feed(html)
        return parser.injectJSHandler

    # Only convert the body to bytes if needed
    if isinstance(body, str):
        body = bytes(body, "utf-8")
    # Regex for between 24 and 72 (aka 24*3) characters encapsulated by the walls
    regex = re.compile(b"""%s.{24,72}?%s""" % (FRONT_WALL, BACK_WALL))
    matches = regex.findall(body)
    for index, match in enumerate(matches):
        # Where the string is injected into the HTML
        in_script_val = in_script(match, index, body)
        in_HTML_val = in_HTML(match, index, body)
        in_tag = not in_script_val and not in_HTML_val
        in_single_quotes = inside_quote("'", match, index, body)
        in_double_quotes = inside_quote('"', match, index, body)
        # Whether you can inject:
        inject_open_angle = b"ao<ac" in match  # open angle brackets