1

When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe?

/^[A-Za-z]+$/
multithr3at3d
  • 12,355
  • 3
  • 29
  • 42
Jordan Baron
  • 9
  • 1
  • Does it have the *multiline* flag set? If you you can do `\n` – paj28 May 13 '20 at 11:39
  • It entirely depends on the context wherein it is injected. Generally such a string regex won't allow XSS regardless of where you would reasonably allow it to be inputted to. This isn't always the case though and depends, again, on implementation. – Cillian Collins May 18 '20 at 13:42

1 Answers1

2

Well, this regex is simple enough to be sure that you won't be able to inject any special character in your input. You won't be able to perform any XSS, unless there is another vulnerability elsewhere.

Benoit Esnard
  • 13,942
  • 7
  • 65
  • 65