What's in a tag name? JavaScript, apparently
Refract AI Intelligence Digest
BLUF
HTML tag name parsing quirks allow attackers to inject executable JavaScript via non-standard characters.
NEWS
Researchers investigated character restrictions in HTML tags and discovered vectors beyond the expected alphanumeric start. The study reveals how specific browser parsing behaviors can be exploited to execute scripts within tag names.
Why I Care
This impacts web application security by undermining input validation that assumes safe tag structures, potentially leading to Cross-Site Scripting (XSS) attacks and data compromise.
Next Steps
Security teams should audit HTML sanitization libraries for tag name validation logic, while developers must update WAF rules to block non-standard characters in tags immediately.
I was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t
Source: PortSwigger Research ·