Other nomination
Bypassing CSP for fun, no profit
A Content Security Policy bypass using UTF-7 and JSON. Any site with a JSON feed an attacker can influence can carry fully UTF-7 encoded script, because the encoding conceals quotes and other string characters from correct JSON escaping. Referencing the feed with a script tag and charset=utf-7 executes it as same-origin code, so CSP's restrictions do not apply.
Record
- Researcher
- Gareth Heyes
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.