1

When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe?

/^[A-Za-z]+$/
2
  • Does it have the multiline flag set? If you you can do \n<script>alert(1)</script>
    – paj28
    May 13 '20 at 11:39
  • It entirely depends on the context wherein it is injected. Generally such a string regex won't allow XSS regardless of where you would reasonably allow it to be inputted to. This isn't always the case though and depends, again, on implementation. May 18 '20 at 13:42
2

Well, this regex is simple enough to be sure that you won't be able to inject any special character in your input. You won't be able to perform any XSS, unless there is another vulnerability elsewhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.