1

I have testing for XSS-injection.

The code contains eval function of javascript.

when if takes some javascript code evaluates the script .

I have very basic idea of regular expressions.

I have been searching for regular expression which might filter the contents and might not allow the javascript code inside eval function .

I need to validate the input in short before passing the parameter to eval function. Any help regarding this will be valuable .

Thanks in advance, Tazim.

theazureshadow
  • 9,499
  • 5
  • 33
  • 48
Star123
  • 669
  • 2
  • 8
  • 19

1 Answers1

1

You're gonna lose that battle, because no regexp can protect from things like hasegawa's XSS vector

(É=[Å=[],µ=!Å+Å][µ[È=-~-~++Å]+({}+Å) [Ç=!!Å+µ,ª=Ç[Å]+Ç[+!Å],Å]+ª])() [µ[Å]+µ[Å+Å]+Ç[È]+ª](Å)
($=[$=[]][(__=!$+$)[_=-~-~-~$]+({}+$)[_/_]+($$=($_=!''+$)[_/_]+$_[+$])])()[__[_/_]+__[_+~$]+$_[_]+$$](_/_)

which is just an alert

p0deje
  • 3,903
  • 1
  • 26
  • 37