CODEWITHSUNDEEP
xssowasppayloadexploitpenetration-testing
Bharadwaja Andy
Bharadwaja Andy

Reputation: 1

Possibilities of Bypassing the Constructed attributes for input sanitization

Hello All I have implemented the following pattern for sanitizing the XSS input. Can you help me if there is any possibility or any payload that can be constructed in bypassing the below patterns

str = str.replaceAll("\\<.*?\\>", ""); str = str.replaceAll("\\&lt;.*?\\&gt;", "");
private static final String XSS_PATTERN = "<(?:img\\s+src\\s*=\\s*[^>]+\\s+onerror\\s*=\\s*\"?[^>]*prompt\\(.*\\)[^>]*>|script\\s*>[^<]*alert\\(.*\\)[^<]*</script\\s*)>|<\\s*img\\s+src\\s*=\\s*[^>]+\\s+onerror\\s*=\\s*\"?[^>]*prompt\\(.*\\)[^>]*>|<\\s*img\\s+src\\s*=\\s*[^>]*\\b(onerror=eval\\(src\\))[^>]*>|script\\s*>.*\\</script\\s*>|style\\s*>.*\\</style\\s*>";
    private static final String XSS_PATTERN2 = "&lt;(?:img\\s+src\\s*=\\s*[^&gt;]+\\s+onerror\\s*=\\s*\"?[^&gt;]*prompt\\(.*\\)[^&gt;]*&gt;|script\\s*&gt;[^&lt;]*alert\\(.*\\)[^&lt;]*&lt;/script\\s*)&gt;|&lt;\\s*img\\s+src\\s*=\\s*[^&gt;]+\\s+onerror\\s*=\\s*\"?[^&gt;]*prompt\\(.*\\)[^&gt;]*&gt;|&lt;\\s*img\\s+src\\s*=\\s*[^&gt;]*\\b(onerror=eval\\(src\\))[^&gt;]*&gt;|script\\s*&gt;.*\\&lt;/script\\s*&gt;|style\\s*&gt;.*\\&lt;/style\\s*&gt;";

Upvotes: 0

Views: 32

Answers (0)

Related Questions