> Have you ever encountered a website that runs jQuery(location.hash)?
No. Actually I have never seen a website do that. What sites do that? What is the actual use of grabbing an element that has an ID that matches the URL hash?
And this attack will only work on those sites.
This is just one more variation of the best practice: don't trust user/client supplied data.
Edit: Though academically I actually find how this was implemented to be really interesting. I'm just not sure what uses it would have in the wild.
No. Actually I have never seen a website do that. What sites do that? What is the actual use of grabbing an element that has an ID that matches the URL hash?
And this attack will only work on those sites.
This is just one more variation of the best practice: don't trust user/client supplied data.
Edit: Though academically I actually find how this was implemented to be really interesting. I'm just not sure what uses it would have in the wild.