I was just looking at Dom based xss and wondering if hash value is written to a variable in javascript context can lead to Cross site scripting. The code looks something like this:

var myhash=window.location.hash;

Is the above code vulnerable to xss?

  • No, it’s not. You should take a close look at how the typical exploit works and how an injected script can actually be executed.
    – Ry-
    Jun 22, 2015 at 5:53
  • 1
    Currently no, but it depends on what happens to myhash. If you run it through an eval() or so it might be.
    – ndrix
    Jun 22, 2015 at 6:04
  • @m1ke or even a simple "document.write()", or any element.append, or or or...
    – AviD
    Jun 22, 2015 at 9:06

1 Answer 1


XSS only happens when data is output.

In your code sample you are setting the variable myhash to the hash value in the address bar. As your code doesn't contain any sinks and your variable is not output, the above code, in isolation, is not vulnerable.

However, to check for XSS vulnerabilities you need to focus on output to your application rather than input. Here application encompasses both the server-side and client-side.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .