Can at this code the input.value be a Dom-XSS sink?

let qs=new urlsearch(location.search);
let paramValue=qs.param;

let input=document.getElementByID('inputField');

I tried these payloads, but they don't work.

>< script>alert(1)< /script>

I wondered because when the payload is reflected from the server side, inside the value attribute, the input tag will be broken and the XSS should be triggered!

1 Answer 1


No, the value attribute is not a sink, and this is actually the proper way to assign a value.

See eg OWASP DOM prevention, Guideline #3:

Examples of safe attributes includes: [...] value"

If it were vulnerable, a correct payload would need to use " (to break out of the existing double-quoted attribute context). Eg " onclick="alert(1)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .