Web Security · Senior · Question 9 of 75
What is a script gadget?
- 1A browser extension that blocks scripts
- 2A small inline script allowed by a hash
- ✓Correct answer: Existing legitimate code that turns harmless-looking injected markup into script execution, for example a library reading
data-*attributes
Explanation
Gadgets in frameworks and libraries can bypass sanitizers and some CSPs, because the code doing the work is trusted.