Is it possible to bypass this Xss Filter?

Question

I was creating an XSS filter for my node plugin. Is there any way to bypass it? If yes How can i prevent it?

function xSSFilter(str) {
        return str
            .replace(/&/g, '&')
            .replace(/"/g, '"')
            .replace(/'/g, ''')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;');
    }

Answer 1

Output encoding is context-specific. If you're only putting the output of this function into HTML text elements - not into attributes, not into strings (or anywhere else) in a script, not into CSS, etc. - you might be OK. For now. If you're aiming for any other context, you're definitely not OK. Here are just a few (this isn't a comprehensive list, don't try to make a comprehensive list, you'll most likely fail and even if you don't the next ECMAScript or HTML update will break your magical unicorn of a viable blacklist for you).

• You're not filtering \, which can be used to escape the legitimate string-ending ' or ". If the attacker controls another string on the same line, that string will be interpreted as code.
• You're not filtering `, which is used to delimit template strings in JS; an attacker would be able to break out of one of those trivially.
• You're not filtering ${ or }, which are used to create expressions for expansion within a template string; the text between them is treated as code.

Just use output encoding of everything non-alphanumeric if you want to be really safe, or at least use a whitelist of non-alphanumeric characters to not encode (and be conservative with it). If you're using the filter only for a specific context or two (say, HTML text and non-event HTML attributes), you can maybe get by with a specific "blacklist" of characters to filter, but it's riskier than going the other way.

Answer 2

Yes, what you have created is called a blacklist (i.e. characters that can not be used). What you should be creating is a whitelist (i.e. characters that are allowed to be used).

Filter evasion is very common please see the OWASP Filter Evaluation Cheatsheet to see the enormous amount of ways this filter could be bypassed.

Also, as this is javascript, I assume this is just on the clients side. Client side validation should only be used to improve user experience. It should not be used for validation. Your server side script should be used for validation.