Thats the code :

var playURL = window.location.href;
var queryString = playURL.split("?")[1];

if (queryString){
    params = queryString.split("image=")[1]
} else{
    params = "none";
if (!params){
    params = "none";

closed as unclear what you're asking by Steffen Ullrich, Xander, Rory Alsop Jan 13 at 13:49

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    You're not doing anything with the value, are you? – Arminius Jan 12 at 0:05
  • 2
    The question can not be answered since it is unknown what the code will do with the extracted and possible attacker controlled value inside param. Given that the OP does not provide this information although it was explicitly asked for in a comment, I propose to close the question as too broad. – Steffen Ullrich Jan 12 at 10:16

By itself, no, because you aren't actually doing anything with the user-controlled text except running split() on it, and no way to use that to inject code.

It's not very good code - you should use location.search instead of location.href.split("?")[1] for example, and you almost never want to use a real string like "none" to indicate the lack of a value, especially if the value's expected type is string (instead, use one of the built-in values like null or undefined) - but it isn't inherently insecure. Of course, depending on what you do with your variables, it could easily become vulnerable, but by itself it is not.

To avoid adding a vulnerability:

  • Do not, under any circumstance, use eval() on user-influenced data. It's best to just avoid it (and its equivalents) altogether.
  • Do not use user-controlled data as identifiers for JavaScript objects, especially if the the user also has some control over the value assigned to a property or passed to a function.
  • Do not insert user-influenced data into the DOM (such as using innerHTML) without first sanitizing it, and where possible, use functions or properties that automatically sanitize the content rather than trying to do it yourself.
  • Be careful using user-controlled data to build URLs (for anything from top-level navigation to image sources) to avoid letting an attacker control the recipient of the request in a way that leaks information or loads malicious content.

Not the answer you're looking for? Browse other questions tagged or ask your own question.