Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Can an attacker bypass this XSS filter?

maris | Last updated: Apr 08, 2016 10:02PM UTC

I have a classified site, I was wondering if this is secure enough or not, between I got this filter from a friend of mine. var a = window.location.hash.replace(/[^\w\-#]/g, "_"); a = a + ".expandable"; if (0 < jQuery(a).length) { a = jQuery(a).find(".exw-control"); if (0 < a.length) a.trigger("expand",null); } It looks like the first line filters out all characters except word characters (\w), - and # by replacing them with an underscore, before passing them to the jQuery function. Is an attacker able to bypass that filter and get some javascript to execute (e.g. an alert), I need to know if yes because of the sensitive content of my site.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.