Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
-
1It certainly avoids the mentioned examples but it certainly does not stop every possible XSS exploit as in the end it depends on how the user supplied value is actually used. – Gumbo Mar 31 '13 at 16:31
-
what about if it is used like that : document.write( "<script type='text/javascript' src='" + var+ "'><\/script>"); var is controlled by the regex . – kirowaxoaw Mar 31 '13 at 17:15
-
If var is user controlled, that line allows arbitrary script injection. Why would you want to load a script specified by the user? – Erlend Apr 1 '13 at 15:05
No. This doesn't stop all injections.
You mentioned one example:
<script type='text/javascript' src='INJECTIONPOINT'>
The regexp you listed is not enough to stop XSS in that case; an attacker could inject //www.evil.com/kablooey.js, and you're done for. (Comment: the URL //www.evil.com/kablooey.js is treated by browsers as equivalent to http://www.evil.com/kablooey.js, if the containing page was served over http.)
In general, I recommend reading the OWASP recommendations on how to prevent XSS. Sanitize your inputs, and use context-dependent escaping of all outputs (e.g., all values inserted into HTML).
-
i compare with my regex what comes after www.mysite.com/[\w/$!.*-]+$ .now can it be exploited ? – kirowaxoaw Mar 31 '13 at 19:54
-
www.evil.com/kablooey.jsis actually a relative URL (only the path) that is getting resolved to an absolute URL using the current document’s URL as base. So it won’t load anything from www.evil.com. – Gumbo Mar 31 '13 at 20:11 -
so with if i check the src like hat www.mysite.com/[\w/$!.*-]+$ it is impossible to cause a dom based xss ? – kirowaxoaw Mar 31 '13 at 20:42
-
@Gumbo, thank you! I've fixed the attack to one that actually works. Now the fixed version will load something from www.evil.com. – D.W. Apr 1 '13 at 0:13
-
1@kirowaxoaw, you are heading down the wrong path. I've already pointed you to the correct path: start by reading the OWASP recommendations, and follow their advice. Their advice is based upon time-tested experience. – D.W. Apr 1 '13 at 0:13
