1

Is it possible to bypass an XSS filter that replaces the malicious characters? I've prepared this filter: 

searchTextField.replace(/</g, " ")
    .replace(/>/g, " ")
    .replace(/"/g, " ")
    .replace(/'/g, " ")
    .replace(/=/g, " ")
    .replace(/0\\/g, " ")
    .replace(/\\/g, " ")
    .replace(/\//g, " ")
    .replace(/  +/g, " ");

The output appears inside span tag like <span>TextHere</span>. My simple question: Can it be bypassed?

Improve this question

1 Answer 1

Reset to default
2

Yes. This is exploitable in some browsers via UTF-7 techniques, and other older browsers via surrogate Unicode characters (some old browsers let you use weird "equivalent" characters for < and >, for example).

Don't use blacklist filtering. Filtering and encoding are hard problems and you shouldn't try to tackle them yourself. You need to be able to contextually encode content for the specific content type and context you're outputting content to. Consider using a library such as OWASP Reform, which supports PHP, Python, Java, ASP, and ASP.NET platforms.

Improve this answer
2
  • Actually, it's a test application. Can you provide me with some sources? I want to create a PoC on this.
    – Shameer Kashif
    Nov 11, 2018 at 11:45
  • @Shiri I don't understand what you're asking for. The OWASP Reform library comes with examples, if that's what you're looking for.
    – Polynomial
    Nov 11, 2018 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .