# Stored Cross-Site Scripting in Map Share Page

Stored XSS in Mapbox v3/v4 classic map share page via marker titles; stripHTML's textContent decoded entities, executing img onerror payloads.

- Payout: hidden
- Severity: medium
- Program: Mapbox
- Found by: hussain_0x3c
- Disclosed: 2016-04-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/65284
- Library page: https://bugbountylibrary.com/r/h1%3A65284
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:xss

**Target:** Map share page (share.js) on *.tiles.mapbox.com
**Root cause:** stripHTML used textContent, which decodes HTML entities like < back into '<', so sanitized marker titles were re-injected as raw HTML into the share page DOM.
**Steps:**
1. Create a classic map in the online editor and add a marker with title payload `<img src=x onerror=alert(1) "`
2. Save and open the map's share page at `https://a.tiles.mapbox.com/v4/<user>.<mapid>/page.html?access_token=...`
3. stripHTML runs L.mapbox.sanitize then returns textContent, decoding `<` to `<`
4. Payload is inserted into the marker title list DOM and alert(1) fires
**How found:** Researcher added XSS payloads to map marker titles in the classic editor and observed execution on the share page, noting that removing '#' from the URL triggered the reflected/stored execution.
**Exploitation:** Attacker hosts a malicious map and lures a victim to the share URL or embeds it via iframe on an attacker page; the marker title payload executes arbitrary JS in the tiles.mapbox.com origin.
**Insight:** Sanitize-then-textContent round-trips are dangerous: textContent decodes entities, so re-inserting the result as HTML re-arms the payload. Test marker/label fields that pass through stripHTML-style helpers.