# Reflected XSS on https://www.starbucks.co.uk/shop/paymentmethod/ (bypass for 227486)

Double-encoded quote in URL path breaks out of canonical link href on starbucks.co.uk, yielding reflected XSS on the payment page.

- Payout: hidden
- Severity: medium
- Program: Starbucks
- Found by: bayotop
- Disclosed: 2020-06-16
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/252908
- Library page: https://bugbountylibrary.com/r/h1%3A252908
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:firefox technique:incomplete-fix technique:source-review vuln:xss

**Target:** www.starbucks.co.uk canonical link element / paymentmethod page
**Root cause:** The full URL is reflected unencoded into the <link rel="canonical" href="..."> attribute; the WAF only blocked %u0022, so %2522 in the path decodes to a quote and breaks the attribute context.
**Steps:**
1. Login at https://www.starbucks.co.uk and add a card to basket at /shop/card/egift/birthday
2. Visit `https://www.starbucks.co.uk/shop/paymentmethod/hkjhk%2522onclick=%2522confirm(/-/g+this.ownerDocument.domain)%2522id=%2522checkoutButton`
3. Click near the Checkout header
4. Alert with current domain fires (Firefox)
**How found:** Follow-up on prior report #227486: noticed quotes still unencoded in the canonical link element, then found the WAF bypass by double-encoding the quote as %2522 in the URL path (not query string).
**Exploitation:** Attacker crafts a URL whose path contains %2522, which survives WAF filtering and decodes to a quote in the canonical href, injecting an onclick handler with id=checkoutButton; victim clicking the Checkout header executes attacker JS in the starbucks.co.uk origin.
**Insight:** When a WAF fix blocks one encoding of a dangerous char (e.g. %u0022), try alternate encodings like %2522 and place the payload in the path rather than query string, since path reflection into canonical/href tags is often overlooked.