Fix base64 data URI scripts function
Watch out!

jQuery is full of secrets. html method is not just a simple wrapper around innerHTML property.

Possible fail condition:



var src = `if ("&lt;x/&gt;" !== "&lt;" + "x" + "/" + "&gt;") {
  console.log("Math gone wrong.");
}`;

$("&lt;script&gt;").html(src).appendTo(document.head)
&lt;!-- latest jQuery --&gt;
&lt;script src="https://code.jquery.com/jquery-3.3.1.min.js"&gt;&lt;/script&gt;




Let's see what exactly is happening here:



console.log($("&lt;i&gt;").html("&lt;x/&gt;")[0].innerHTML)
&lt;!-- latest jQuery --&gt;
&lt;script src="https://code.jquery.com/jquery-3.3.1.min.js"&gt;&lt;/script&gt;




jQuery html method replaces &lt;x/&gt; with &lt;x&gt;&lt;/x&gt;. I guess it is perfectly valid for some HTML, but it fails with our JavaScript input.

The π robbery

Let's try to exploit this with malicious input and steal some valuable data:



var src = `var username = "Kevin &lt;x\";alert(Math.PI);\"/&gt; Mitnick";`;

$("&lt;script&gt;").html(src).appendTo(document.head);
&lt;!-- latest jQuery --&gt;
&lt;script src="https://code.jquery.com/jquery-3.3.1.min.js"&gt;&lt;/script&gt;




I suggest you to carefully check jQuery html source code.

Also you may replace it with plain old innerHTML.