Is use of the ASP.Net Request.QueryString safe in JavaScript?

Question

Consider the following code:

function redirect() {
    window.location = "../../index.aspx?<%=Request.QueryString%>";
}

Is this code safe or can it be exploited by an XSS attack?

If so:

Definitely exploitable. You need to do some encoding to prevent JavaScript from being injected via the query string. — Andrew Barber
– Andrew Barber, Commented Mar 12, 2013 at 11:07
If the user takes his browser somewhere else, would that count as XSS? I don't think so. Sure this allows me to play javascript tricks, but other users should be safe. — nunespascal
– nunespascal, Commented Mar 12, 2013 at 11:10
Think of this as a querystring: xx"; $.runBadJavascript(); window.location = "whatever — Andrew Barber
– Andrew Barber, Commented Mar 12, 2013 at 11:12
@nunespascal you seem to be making a common mistake: thinking no one would send someone else a malicious link. That's the basis of many xss attacks. — Andrew Barber
– Andrew Barber, Commented Mar 12, 2013 at 11:14

Andrew Barber · Accepted Answer · 2013-03-12 11:31:16Z

4

Consider this as a querystring:

Xx"; alert('pwned'); window.location ="whatever

Basically, you are allowing completely arbitrary JavaScript to be injected.

Best solution: never take direct user input and use it this way.

Second best solution: encode it for use in a JavaScript string before using it there. A simple " breaks out here.

Also; do not mistakenly do HTML encoding for this. That won't work right and will still be vulnerable.

answered Mar 12, 2013 at 11:23

Andrew Barber

40.3k20 gold badges97 silver badges124 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Umm... Request.Querystring returns the raw, unencoded string. It is not encoded.

@kees but it is not the ; that is your problem here; it's the "

@kees and the WebForms engine (aspx, etc) is not encoding with <%= either.