Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

This lab isolates Stored dangerous URL scheme. The comment website value becomes the author anchor href. Double quotes are encoded, but the application does not restrict URL schemes. The value stays inside the quoted attribute yet remains executable as a JavaScript URL when the author name is followed.

Lab objective/setup

Open the Academy exercise at the reserved lab URL and work only in that disposable environment. The required proof is specific: Clicking the stored comment author link fires the alert and solves the lab.

What I observed

The comment website value becomes the author anchor href. Double quotes are encoded, but the application does not restrict URL schemes. The value stays inside the quoted attribute yet remains executable as a JavaScript URL when the author name is followed.

Academy objective requiring stored XSS through the comment author link when the author name is clicked.
Academy objective requiring stored XSS through the comment author link when the author name is clicked.
Rendered comment shows an image-like test string as the clickable author text, demonstrating that the Website field controls the author anchor destination.
Rendered comment shows an image-like test string as the clickable author text, demonstrating that the Website field controls the author anchor destination.

Why it is vulnerable

The application applies protection for the wrong parser or omits a control at the decisive boundary. In this case, the comment website value becomes the author anchor href. Double quotes are encoded, but the application does not restrict URL schemes. Browser parsing therefore preserves the attacker-controlled behavior instead of reducing the value to inert text or a safe URL.

Walkthrough in the authorized PortSwigger lab

First reproduce the recorded page or request and inspect the exact reflected, stored, or DOM-generated context described above. Then supply the following lab payload as data, not as active markup in this article:

1
`javascript:alert(1)`

The value stays inside the quoted attribute yet remains executable as a JavaScript URL when the author name is followed.

Developer Tools highlights the author anchor whose `href` contains the inert text `javascript:alert(1)` while the comment body contains the separate image test string.
Developer Tools highlights the author anchor whose `href` contains the inert text `javascript:alert(1)` while the comment body contains the separate image test string.
Browser alert dialog showing `1` after the stored author link is clicked and its JavaScript URL is followed.
Browser alert dialog showing `1` after the stored author link is clicked and its JavaScript URL is followed.

Verification

Clicking the stored comment author link fires the alert and solves the lab. This distinguishes execution from a payload merely appearing in source or being stored without reaching the required event or sink.

Impact and defensive lesson

In a real application, equivalent XSS could act with the victim’s same-origin privileges, expose readable data, or perform authenticated actions. Fix the data flow at its context: use text-only DOM APIs, JavaScript- or attribute-aware encoding, strict URL-scheme allowlists, and maintained sanitization where HTML is unavoidable. HttpOnly cookies and a restrictive CSP reduce consequences but do not repair the injection flaw.

References