I was looking at WebSockets today (because of its use in
Firebase which is used in one of AngularJS samples), and noticed an DOM
XSS example on the
WebSocket echo page which is used as an example of how to use WebSockets (I found that page from this article
Inspecting WebSocket Traffic with Chrome Developer Tools)
For historical record (and to reuse them in a Javascript SAST) I've copied the current (vulnerable) version of the HTML and JS provided
to this gist.
Code samples (like these) should not be provided with these types of security vulnerabilities, since they should represent best practices.
Specially when we know that the normal developer workflow is to start with copy-n-pastes from these type of examples (note how that page, as of Fev 2014) has no references to security).
Let see the vulnerability in action.
