1 CONSOLE ERROR: line 4: The XSS Auditor refused to execute a script in 'http://lo
calhost:8000/security/xssAuditor/resources/echo-intertag.pl?clutter=,&q=%3Cscrip
t%20x=%271&%3E&q2=1%27%3Ealert(String.fromCharCode(0x58,0x53,0x53,0x31))%3C/scri
pt%3E' because its source code was found within the request. The auditor was ena
bled as the server did not send an 'X-XSS-Protection' header. | 1 CONSOLE ERROR: line 4: The XSS Auditor refused to execute a script in 'http://lo
calhost:8000/security/xssAuditor/resources/echo-intertag.pl?clutter=,&q=%3Cscrip
t%20x=%271&%3E&q2=1%27%3Ealert(String.fromCharCode(0x58,0x53,0x53,0x31))%3C/scri
pt%3E' because its source code was found within the request. The server sent an
'X-XSS-Protection' header requesting this behavior. |
3 Test that the XSSAuditor catches the specific case where the IIS webserver resov
les multiply occuring query parameters by concatenating them before passing the
result to the application. Conceptually, its as if ?a=1&a=2 becomes ?a=1,2. The
test passes if the XSSAuditor logs console messages and no alerts fire. | 3 Test that the XSSAuditor catches the specific case where the IIS webserver resov
les multiply occuring query parameters by concatenating them before passing the
result to the application. Conceptually, its as if ?a=1&a=2 becomes ?a=1,2. The
test passes if the XSSAuditor logs console messages and no alerts fire. |