1

When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe?

/^[A-Za-z]+$/
Improve this question
2
  • Does it have the multiline flag set? If you you can do \n<script>alert(1)</script>
    – paj28
    May 13, 2020 at 11:39
  • It entirely depends on the context wherein it is injected. Generally such a string regex won't allow XSS regardless of where you would reasonably allow it to be inputted to. This isn't always the case though and depends, again, on implementation.
    – Cillian Collins
    May 18, 2020 at 13:42

1 Answer 1

Reset to default
2

Well, this regex is simple enough to be sure that you won't be able to inject any special character in your input. You won't be able to perform any XSS, unless there is another vulnerability elsewhere.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .