# Reflected DOM XSS on www.starbucks.co.uk

Reflected DOM XSS on Starbucks UK via canonical-link attribute injection chained with prettyPhoto's jQuery selector sink to trigger onclick.

- Payout: hidden
- Severity: medium
- Program: Starbucks
- Found by: bayotop
- Disclosed: 2020-06-16
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/396493
- Library page: https://bugbountylibrary.com/r/h1%3A396493
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:chained technique:source-review vuln:xss

**Target:** www.starbucks.co.uk shop egift thank-you page
**Root cause:** Unescaped backslash in prettyPhoto's hashRel sanitizer allows arbitrary jQuery selectors; combined with an HTML attribute injection into the canonical link element, an attacker-controlled onclick fires.
**Steps:**
1. Visit `https://www.starbucks.co.uk/shop/card/egift/thank-you/anything%2522onclick=%2522confirm(document.domain)#!\'\,\*\,/1` in Firefox or Edge
2. The path injects `onclick="confirm(document.domain)` into the `<link rel="canonical">` element
3. prettyPhoto parses the `#!` hash, sanitizes hashRel but leaves `\` unescaped
4. The crafted hashRel `\'\,\*\,` builds selector `a[rel^='\\'\\,\\*\\,']:eq(NaN)` which matches all elements
5. `.trigger("click")` fires the injected onclick, executing confirm(document.domain)
**How found:** Noticed the canonical link attribute injection (#252908) was unfixed, then read prettyPhoto source and observed the hashRel sanitizer escapes `=` but not `\`, allowing arbitrary jQuery selectors; combined both.
**Exploitation:** Attacker crafts a URL with the encoded attribute injection in the path and the prettyPhoto hash payload; victim visiting it executes arbitrary JS in the starbucks.co.uk origin.
**Escalation:** Chains two individually low-impact issues (attribute injection + prettyPhoto selector injection) into full XSS.
**Insight:** When a sanitizer escapes some regex metacharacters but not backslash, you can break out of a quoted jQuery selector; look for sinks like `$("a[rel^='"+input+"']")` and pair with any HTML attribute injection on the same page.