Skip to main content
2 of 3
added 33 characters in body
CodesInChaos
  • 12.2k
  • 2
  • 43
  • 50

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript?

<script>      
  function json(a){
    
  if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, "@").replace(/"[^"\\\n\r\u2028\u2029\x00-\x08\x0a-\x1f]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, "]").replace(/(?:^|:|,)(?:[\s\u2028\u2029]*\[)+/g, ""))) 
    try{
         return eval("(" + a + ")")
    } catch (b) {}
    
    g(Error("Invalid JSON string: " + a))
  }

  json(window.name);    
</script>
LucasNN
  • 81
  • 1
  • 3