Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does the regex [\w/$!.*-]+$ stop the injection of payloads like :

" onload="alert(4)"
share|improve this question
It certainly avoids the mentioned examples but it certainly does not stop every possible XSS exploit as in the end it depends on how the user supplied value is actually used. – Gumbo Mar 31 '13 at 16:31
what about if it is used like that : document.write( "<script type='text/javascript' src='" + var+ "'><\/script>"); var is controlled by the regex . – kirowaxoaw Mar 31 '13 at 17:15
If var is user controlled, that line allows arbitrary script injection. Why would you want to load a script specified by the user? – Erlend Apr 1 '13 at 15:05

No. This doesn't stop all injections.

You mentioned one example:

<script type='text/javascript' src='INJECTIONPOINT'>

The regexp you listed is not enough to stop XSS in that case; an attacker could inject //, and you're done for. (Comment: the URL // is treated by browsers as equivalent to, if the containing page was served over http.)

In general, I recommend reading the OWASP recommendations on how to prevent XSS. Sanitize your inputs, and use context-dependent escaping of all outputs (e.g., all values inserted into HTML).

share|improve this answer
i compare with my regex what comes after[\w/$!.*-]+$ .now can it be exploited ? – kirowaxoaw Mar 31 '13 at 19:54 is actually a relative URL (only the path) that is getting resolved to an absolute URL using the current document’s URL as base. So it won’t load anything from – Gumbo Mar 31 '13 at 20:11
so with if i check the src like hat[\w/$!.*-]+$ it is impossible to cause a dom based xss ? – kirowaxoaw Mar 31 '13 at 20:42
@Gumbo, thank you! I've fixed the attack to one that actually works. Now the fixed version will load something from – D.W. Apr 1 '13 at 0:13
@kirowaxoaw, you are heading down the wrong path. I've already pointed you to the correct path: start by reading the OWASP recommendations, and follow their advice. Their advice is based upon time-tested experience. – D.W. Apr 1 '13 at 0:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.