Later archive addition

Bypassing CSP using polyglot JPEGs

Gareth Heyes · PortSwigger Research · 1 December 2016

The article constructs a file that is simultaneously a valid JPEG and executable JavaScript, including a compact variant for upload limits. When uploaded to a same-origin path permitted by CSP, the polyglot can be loaded as script to bypass the policy.

Record

Researcher

Gareth Heyes

Published by

PortSwigger Research

Date

1 December 2016

In the archive

• Added to the 2016–17 archive after the original list was published

Tags

• csp
• file-upload
• mime
• javascript
• filter-bypass
• xss
• browser
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.