Burp : Data is read from document.location and passed to $() via the following statements

Question

How to deal with this code ? Data is read from document.location and passed to $() via the following statements:

 var url =  document.location.toString();
 $('.nav-tabs a[href="#' + url.split('#')[1] + '"]').tab('show');

Answer 1

The question is this case would be what could come after the # in the URL. Most browsers will URL-encode special chars, but there may still be ways to get around it, especially in legacy browsers.

Regardless of that, I think it's a good idea to validate data before you use it. If you can restrict the accepted values to let's say a-z (and possibly numbers and dashes), there shouldn't be a way to exploit it.

var tab =  document.location.toString().split('#')[1];
if (tab && !/[^a-zA-Z0-9]/.test(tab)) $('.nav-tabs a[href="#' + tab + '"]').tab('show');