javascript hacks using cross site scripting - where is the injection of code posted to : <p>I am new coder doing a web security tutorial that looks at javascript hacks using cross site scripting in a rails project.</p>

<p>In my project, I have injected a piece of malicious javascript into the user_first_name input field on our account_settings.html.erb which in turn generates a dialogue box to say that you have been hacked every time you refresh or visit a new page. (Please see screenshots)</p>

<p>Problem: the lecturer has finished without explaining how to clear this rogue code from our project and I can't get shot of the annoying dialogue box.</p>

<p>I can see the XSS code in the view page source but I am having difficult finding it in my project in the views nor can I source it using the command T function in sublime.</p>

<p>I am not seeking security advice, merely steering as to where this injection of XSS code can be found within my project or is posted to so that I may clear it. </p>

<p><a href="https://i.stack.imgur.com/07azI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/07azI.png" alt="enter image description here"></a>
<a href="https://i.stack.imgur.com/r4A3j.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/r4A3j.jpg" alt="enter image description here"></a></p>

<blockquote>
  <p>new.html.erb </p>
</blockquote>

<pre><code>&lt;div class="row-fluid"&gt;
  &lt;div class="span12"&gt;

        &lt;div class="row-fluid"&gt;
          &lt;div class="span4 offset4"&gt;
            &lt;div class="signup"&gt;
      &lt;%= form_for @user, :html =&gt; {:id =&gt; "account_edit", :class=&gt; "signup-wrapper"} do |f| %&gt;

          &lt;div class="header"&gt;
                    &lt;h2&gt;Sign Up&lt;/h2&gt;
                    &lt;p&gt;Fill out the form below to login&lt;/p&gt;
                  &lt;/div&gt;

          &lt;div class="content"&gt;
                &lt;%= f.text_field :email, {:class =&gt; "input input-block-level", :placeholder =&gt; "Email"} %&gt;

                &lt;%= f.text_field :first_name, {:class =&gt; "input input-block-level", :placeholder =&gt; "First Name"} %&gt;

                &lt;%= f.text_field :last_name, {:class =&gt; "input input-block-level", :placeholder =&gt; "Last Name"} %&gt;

                  &lt;div class="control-group"&gt;
                  &lt;%= f.password_field :password, {:class =&gt; "input input-block-level", :placeholder =&gt; "Password"}%&gt;
              &lt;/div&gt;
              &lt;div class="control-group"&gt;
                  &lt;%= f.password_field :password_confirmation, {:class =&gt; "input input-block-level", :placeholder =&gt; "Confirm Password"}%&gt;
              &lt;/div&gt;
          &lt;/div&gt;

          &lt;div class="actions"&gt;
            &lt;%= f.submit "Submit", {:id =&gt; 'submit_button', :class =&gt; "btn btn-info btn-large pull-right"} %&gt;
          &lt;/div&gt;
          &lt;div class="clearfix"&gt;&lt;/div&gt;
        &lt;% end %&gt;

            &lt;/div&gt;
          &lt;/div&gt;
        &lt;/div&gt;

  &lt;/div&gt;
&lt;/div&gt;
</code></pre>

<blockquote>
  <p>account_settings.html.erb </p>
</blockquote>

<pre><code>&lt;div class="dashboard-wrapper"&gt;
  &lt;div class="main-container"&gt;
    &lt;div class="row-fluid"&gt;
      &lt;div class="span12"&gt;
        &lt;div id="success" style="display: none;" class="alert alert-block alert-success fade in"&gt;
                &lt;h4 class="alert-heading"&gt;
                  Success!
                &lt;/h4&gt;
                &lt;p&gt;
                  Information successfully updated.
                &lt;/p&gt;
              &lt;/div&gt;
      &lt;/div&gt;
    &lt;/div&gt;
    &lt;div class="row-fluid"&gt;
      &lt;div class="span12"&gt;
        &lt;div id="failure" style="display: none;" class="alert alert-block alert-error fade in"&gt;
                    &lt;h4 class="alert-heading"&gt;
                      Error!
                    &lt;/h4&gt;
                    &lt;p&gt;
                      Failed to update.
                    &lt;/p&gt;
                  &lt;/div&gt;
      &lt;/div&gt;
    &lt;/div&gt;
    &lt;div class="row-fluid"&gt;
        &lt;div class="span6"&gt;
          &lt;div class="widget"&gt;
            &lt;div class="widget-header"&gt;
              &lt;div class="title"&gt;
                &lt;span class="fs1" aria-hidden="true" data-icon="&amp;#xe090;"&gt;&lt;/span&gt; Profile Settings
                &lt;span class="mini-title"&gt;
                  Edit your account details
                &lt;/span&gt;
              &lt;/div&gt;
            &lt;/div&gt;
            &lt;div class="widget-body"&gt;
           &lt;%= form_for @user, :html =&gt; {:id =&gt; "account_edit"} do |f|%&gt;
               &lt;%= f.hidden_field :user_id%&gt;
          &lt;div class="control-group"&gt;
                  &lt;%= f.label :email, nil, {:class =&gt; "control-label"}%&gt;
            &lt;%= f.text_field :email, {:class =&gt; "span12"}%&gt;
          &lt;/div&gt;

          &lt;div class="control-group"&gt;
            &lt;%= f.label :first_name, nil, {:class =&gt; "control-label"}%&gt;
            &lt;%= f.text_field :first_name, {:class =&gt; "span12"} %&gt;
          &lt;/div&gt;

          &lt;div&gt;
            &lt;%= f.label :last_name, nil, {:class =&gt; "control-label"}%&gt;
            &lt;%= f.text_field :last_name, {:class =&gt; "span12"} %&gt;
          &lt;/div&gt;

          &lt;div class="control-group"&gt;
            &lt;%= f.label :password, nil, {:class =&gt; "control-label"}%&gt;
            &lt;%= f.password_field :password, {:class =&gt; "span12", :placeholder =&gt; "Enter Password"}%&gt;
          &lt;/div&gt;

          &lt;div class="control-group"&gt;
              &lt;%= f.label :password_confirmation, nil, {:class =&gt; "control-label"}%&gt;
              &lt;%= f.password_field :password_confirmation, {:class =&gt; "span12", :placeholder =&gt; "Enter Password"} %&gt;
            &lt;/div&gt;

          &lt;div class="form-actions no-margin"&gt;
            &lt;%= f.submit "Submit", {:id =&gt; 'submit_button', :class =&gt; "btn btn-info pull-right"} %&gt;
          &lt;/div&gt;

          &lt;div class="clearfix"&gt;
                &lt;/div&gt;
           &lt;% end %&gt;

      &lt;/div&gt;
    &lt;/div&gt;
  &lt;/div&gt;
&lt;/div&gt;

&lt;%= javascript_include_tag ('validation.js')%&gt;

&lt;script type="text/javascript"&gt;

$("#submit_button").click(function(event) {
    var valuesToSubmit = $("#account_edit").serialize();
    event.preventDefault();
    $.ajax({
      url: &lt;%= "/users/#{current_user.user_id}.json".inspect.html_safe %&gt;,
    data: valuesToSubmit,
    type: "POST",
    success: function(response) {
    if (response.msg == "failure") {
      $('#failure').show(500).delay(1500).fadeOut();
    } else {
      $('#success').show(500).delay(1500).fadeOut();
    }
    },
    error: function(event) {
    $('#failure').show(500).delay(1500).fadeOut();
    }
  });
});

&lt;/script&gt;
</code></pre>

<blockquote>
  <p>_header.html.erb </p>
</blockquote>

<pre><code>&lt;header&gt;
    &lt;span style="color:#eee;margin-left:10px;"&gt;
     Font Size:
     &lt;a href="&lt;%= home_dashboard_index_path %&gt;?font=8pt" style="font-size:10pt;color:#eee;"&gt;A&lt;/a&gt;
     &lt;a href="&lt;%= home_dashboard_index_path %&gt;?font=200%25" style="font-size:18pt;color:#eee;"&gt;A&lt;/a&gt;
   &lt;/span&gt;
     &lt;div class="user-profile"&gt;
       &lt;a data-toggle="dropdown" class="dropdown-toggle"&gt;
         &lt;img src=" &lt;%= image_path('profile_color.jpg')%&gt;"  alt="profile"&gt;

       &lt;/a&gt;
       &lt;span class="caret"&gt;&lt;/span&gt;
       &lt;ul class="dropdown-menu pull-right"&gt;
         &lt;li&gt;
      &lt;%= link_to "account settings", user_account_settings_path(:user_id =&gt; current_user.user_id) %&gt;
         &lt;/li&gt;
         &lt;li&gt;
           &lt;%= link_to "logout", logout_path %&gt;
         &lt;/li&gt;
       &lt;/ul&gt;
     &lt;/div&gt;
     &lt;ul class="mini-nav"&gt;
     &lt;li style="color: #FFFFFF"&gt;
    &lt;!--
    I'm going to use HTML safe because we had some weird stuff
    going on with funny chars and jquery, plus it says safe so I'm guessing
    nothing bad will happen
    --&gt;
    Welcome, &lt;%= current_user.first_name.html_safe %&gt;

     &lt;/li&gt;
     &lt;/ul&gt;
&lt;/header&gt;
</code></pre>
