I'm trying to inject javascript into a js scriptfile but it's not working.

I have the following setup:

html file with javascript-file include (all inline js is blocked!)

Welcome, <script src="js/domxss.js" type="text/javascript"></script>

javascript source of js/domxss.js:

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);

Obviously I could just request


and it would be executed, but all inline js is being blocked by my Content-Security-Policy. So what I'm trying to do is to break out of


with something like this:

domain.com/index.html?user=bob); alert(1

so that I can get something like this:


Anyone has an idea on how I could achieve that? I'm not bound on document.write, I'm just looking for a DOM-based XSS example where I can inject JS directly into the script file rather then printing it out as inline code.

Sorry if it seems a basic question but I'm not that familiar with JS.

Thanks for the help :)


1 Answer 1


To put it simply, you can't because your your payload bob); alert(1 is a string, and JavaScript knows its a string so it won't execute it. The parenthesis and semi-colon characters can be inside the string without being executed. This code could be vulnerable if, for example, you tried to concatenate the payload into an eval() statement. This is because eval will execute code inside the resulting string.

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
eval("document.write('" + decodeURI(userInput) + "');");

Then domain.com/index.html?user=bob');%20alert('1 will result in the following string being executed as JavaScript:

document.write('bob'); alert('1');

(This is why eval() is generally a bad idea)

However, a good Content-Security-Policy would probably block user input in eval() as well, so this method may not work. It depends upon the policy returned by the server, or the default controls the browser might load if one isn't specified.

Alternatives to eval()

Other dangerous ways in which a developer could accidentally evaluate user controllable data without sanitisation or validation (that might not be caught by a default CSP or client-side XSS filter).

The function constructor (can define function body as a string):

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
var terribleFunction = new Function( "document.write('" + decodeURI(userInput) + "');" );

A Data URI:

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
var terribleScript = document.createElement('script');
terribleScript.src = 'data:text/javascript,' + encodeURIComponent("document.write('" + decodeURI(userInput) + "');");
document.body.appendChild( terribleScript );

setTimeout (although I think this method is essentially the same as eval()):

var pos=document.URL.indexOf("user=")+5;
var userInput=document.URL.substring(pos,document.URL.length);
setTimeout( "document.write('" + decodeURI(userInput) + "');" , 100 );
  • So since eval() functions are blocked by default by CSP I have to look for other functions that execute strings as javascript. Thanks for your help :)
    – mohrphium
    Commented Mar 2, 2014 at 21:55
  • @mohrphium Yes. Essentially a string needs to be evaluated/executed, or some HTML needs to be output that executes another script (as far as I can see). The latter is likely to be caught by a CSP, so other ways to eval() would probably be the best bet. I've edited to include some examples of this. I've not tested with a default CSP but may try when I get a chance. Interestingly, Chrome's XSS Auditor doesn't catch them though.
    – itscooper
    Commented Mar 2, 2014 at 23:09
  • Awesome, i'll try them later today. Thanks again for your help.
    – mohrphium
    Commented Mar 3, 2014 at 6:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .