Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string?

var userString = "perfectly "safe" input from user?";

share|improve this question
2  
Depends on what you're going to do with the string. –  Rob W Jun 26 '13 at 21:41
    
If nothing done with it and in script tag? –  user27675 Jun 26 '13 at 22:19
add comment

1 Answer

up vote 4 down vote accepted

It is probably not possible to get XSS given this simple character restriction. However, an attacker could inject an escape character, for example:

var userString = "perfectly "safe" input from user?\"+"+alert(1);

In this case the attacker would be injecting a \ and an alert(1) in two different variables which existing in two locations within the <script> tag. Escape characters are a type of control character that are commonly forgotten by developers when sanitizing attacker controlled data.

... also hopefully you took this into consideration:

<script>
var userString = "</script><script>alert(1)//"
</script>
share|improve this answer
2  
In the second example, if " is encoded into &quot;, I hope < and > are too! –  minitech Jun 26 '13 at 23:02
    
@minitech the op failed to mention such a critical detail! –  Rook Jun 27 '13 at 2:48
1  
HTML encoding includes &lt; &amp; &gt;, but good to know for completeness. –  user27675 Jun 27 '13 at 2:59
1  
@user27675 Yes, any character can be HTML encoded, as the HEX format &#xhhhh; supports all of ASCII and even Unicode! However, you did not mention what HTML encode function you used. –  Rook Jun 27 '13 at 3:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.