Can at this code the input.value be a Dom-XSS sink?

let qs=new urlsearch(location.search);
let paramValue=qs.param;

let input=document.getElementByID('inputField');

I tried these payloads, but they don't work.

>< script>alert(1)< /script>

I wondered because when the payload is reflected from the server side, inside the value attribute, the input tag will be broken and the XSS should be triggered!

1 Answer 1


No, the value attribute is not a sink, and this is actually the proper way to assign a value.

See eg OWASP DOM prevention, Guideline #3:

Examples of safe attributes includes: [...] value"

If it were vulnerable, a correct payload would need to use " (to break out of the existing double-quoted attribute context). Eg " onclick="alert(1)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.