-1

I have a classified site, I was wondering if this is secure enough or not, between I got this filter from a friend of mine.

var a = window.location.hash.replace(/[^\w\-#]/g, "_");
a = a + ".expandable";
if (0 < jQuery(a).length) {
  a = jQuery(a).find(".exw-control");
  if (0 < a.length) a.trigger("expand",null);
}

It looks like the first line filters out all characters except word characters (\w), - and # by replacing them with an underscore, before passing them to the jQuery function. Is an attacker able to bypass that filter and get some javascript to execute (e.g. an alert), I need to know if yes because of the sensitive content of my site.

  • 1
    Have you tried the XSS Cheat Sheet tests against the code? – schroeder Apr 8 '16 at 21:15
  • 1
    @schroeder No, I haven't. So you think it's vulnerable or not? – Test Apr 8 '16 at 21:20
1

Don't pass user input to the jQuery or $ function if you don't want it to possibly be interpreted as HTML. Use $.find(a) instead, and then you don't have to worry about filtering it. Though you should do this in a try-catch block because the user could give an invalid selector.

Also, it's good practice to avoid re-using variables like a for different purposes.

try {
  var a = window.location.hash + ".expandable";
  if (0 < jQuery.find(a).length) {
    var control = jQuery.find(a).find(".exw-control");
    control.trigger("expand",null);
  }
} catch(e) {
  console.error("Error processing hash", e);
}
  • Thanks for the answer, I think I cannot change this one, I should keep passing user input to the jQuery.. I did the XSS cheat sheet tests, I cannot see any possible XSS attack, can you also check it? – Test Apr 9 '16 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.