Recently, during a security audit, I found a page in which some URL parameter is reflected inside a <script> tag. It could be an easy XSS, but a line before the reflection there is a syntax error (e.g., string without ending quotes).

Is it possible to make JavaScript code run in spite of a syntax error one or more lines above it?


If there is a syntax error inside a script tag, no code in the block will be executed, neither above or below it. So to get some code running, you have two options:

  • Fix the syntax error using the code you are injecting. Depedning on what kind of error it is, this may or may not be possible. E.g. closing a quote two lines up sounds impossible, but balancing brackets should be doable.
  • End the script tag with the syntax error, and start a new clean one. If there is no filter at all you can inject e.g. <script>alert("XSS");</script><script>-

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.