javascript - XSS - Which browsers automatically escape urls in the address bar?

Question

I have been performing some xss / javascript-injection / penetration-testing on my asp.net site recently and noticed that modern web-browser (ie latest FF and Chrome) are escaping the urls entered into the address bar.

So:

http://example.com/search/?q="><script>alert('hi');</script>

is sent to my server as:

http://example.com/search/?q=%22%3e%3cscript%3ealert(%27hi%27)%3b%3c%2fscript%3e

Is there a list of all (major) browsers that do this and those that do not? Do mobile browsers do this?

score 2 · Accepted Answer

我认为所有浏览器都会转义 url，除了那些有错误且不遵循 RFC ( RFC3986 ) 的浏览器。

score 1 · Accepted Answer

如果我没记错的话，你可以使用http://browsershots.org/或类似的东西来测试它。

2 回答 2