Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityDoes the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
No. This doesn't stop all injections.
You mentioned one example:
<script type='text/javascript' src='INJECTIONPOINT'>
The regexp you listed is not enough to stop XSS in that case; an attacker could inject //www.evil.com/kablooey.js
, and you're done for. (Comment: the URL //www.evil.com/kablooey.js
is treated by browsers as equivalent to http://www.evil.com/kablooey.js
, if the containing page was served over http.)
In general, I recommend reading the OWASP recommendations on how to prevent XSS. Sanitize your inputs, and use context-dependent escaping of all outputs (e.g., all values inserted into HTML).
www.evil.com/kablooey.js
is actually a relative URL (only the path) that is getting resolved to an absolute URL using the current document’s URL as base. So it won’t load anything from www.evil.com.
– Gumbo
Mar 31 '13 at 20:11