Can the value attribute of input tag be a DOM-XSS sink?

Question

Can at this code the input.value be a Dom-XSS sink?

let qs=new urlsearch(location.search);
let paramValue=qs.param;

let input=document.getElementByID('inputField');
input.value=paramValue;

I tried these payloads, but they don't work.

>< script>alert(1)< /script>

 onClick=alert(1)

I wondered because when the payload is reflected from the server side, inside the value attribute, the input tag will be broken and the XSS should be triggered!

Answer 1

No, the value attribute is not a sink, and this is actually the proper way to assign a value.

See eg OWASP DOM prevention, Guideline #3:

Examples of safe attributes includes: [...] value"

_{If it were vulnerable, a correct payload would need to use " (to break out of the existing double-quoted attribute context). Eg " onclick="alert(1)}