2

I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered:

"><script>alert('hi')</script>

If I look at the source of the resulting query I will see the following:

<input name="search" type="text" value=""><script>alert('hi')</script>">

The double quote will be appended automatically at the end of my query.

Assuming that the filter also scrubs out the null char, and HTML comments <!--, would this be an effective XSS filter or is this just wishful thinking?

4
  • What html tag are you injecting into?
    – rook
    Mar 23, 2013 at 18:30
  • sorry my code did not show properly, thanks to Lekensteyn for editing :)
    – Alistair
    Mar 23, 2013 at 18:33
  • the alert box above should execute... did you try this before posting?
    – rook
    Mar 23, 2013 at 18:37
  • Ok, now I got it to work :) And thank you for the reply as well!
    – Alistair
    Mar 23, 2013 at 18:45

1 Answer 1

2

I can think of no condition in which this would mitigate XSS. If an attacker supplies <script>alert(1)</script> the result will be: <script>alert(1)</script>" which will still execute.

Further more, an attacker can just comment out the double quote in javascript: alert(1)//"

You don't need an html comment to build valid html:

<input name="search" type="text" value=""><script>alert('hi')</script><input name="inject">

You should read the XSS prevention cheat sheet, XSS is extremely common and you shouldn't come up with home-brew solutions to well known problems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .