Skip to main content
Information Security

Return to Question

removed scripting tag http://meta.security.stackexchange.com/questions/2192/lets-get-rid-of-scripting-manually
Source Link
edit approved Apr 5, 2016 at 0:22
200_success
edit approved Apr 5, 2016 at 0:22
200_success
  • 2.1k
  • 2
  • 16
  • 20

Is JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascriptJavaScript?

<script>      
  function json(a){
    
  if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) 
    try{
         return eval("(" + a + ")")
    } catch (b) {}
    
    g(Error("Invalid JSON string: " + a))
  }

  json(window.name);    
</script>

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript?

<script>      
  function json(a){
    
  if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) 
    try{
         return eval("(" + a + ")")
    } catch (b) {}
    
    g(Error("Invalid JSON string: " + a))
  }

  json(window.name);    
</script>

JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible?

Is possible to bypass my regex and execute any JavaScript?

<script>      
  function json(a){
    
  if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) 
    try{
         return eval("(" + a + ")")
    } catch (b) {}
    
    g(Error("Invalid JSON string: " + a))
  }

  json(window.name);    
</script>
added 33 characters in body
Source Link
CodesInChaos
CodesInChaos
  • 12.2k
  • 2
  • 43
  • 50

Is possible to bypass my regex and execute any javascript?

function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) try{ return eval("(" + a + ")") } catch (b) {} g(Error("Invalid JSON string: " + a)) }

json(window.name);

<script>      
  function json(a){
    
  if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) 
    try{
         return eval("(" + a + ")")
    } catch (b) {}
    
    g(Error("Invalid JSON string: " + a))
  }

  json(window.name);    
</script>

Is possible to bypass my regex and execute any javascript?

function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) try{ return eval("(" + a + ")") } catch (b) {} g(Error("Invalid JSON string: " + a)) }

json(window.name);

Is possible to bypass my regex and execute any javascript?

<script>      
  function json(a){
    
  if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) 
    try{
         return eval("(" + a + ")")
    } catch (b) {}
    
    g(Error("Invalid JSON string: " + a))
  }

  json(window.name);    
</script>
Tweeted twitter.com/#!/StackSecurity/status/299097388272992257
Source Link
LucasNN
LucasNN
  • 81
  • 1
  • 3

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript?

function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) try{ return eval("(" + a + ")") } catch (b) {} g(Error("Invalid JSON string: " + a)) }

json(window.name);