Search code examples
xsssanitization

XSS when tags are removed from input text


Is it possible to execute an XSS attack if all tags are removed from text? By tags meaning everything matching pattern "<...>" (regex: /<.*?>/g).


Solution

  • Yes:

    <img src=x onerror=alert(1)//
    

    Don't invent your own filters. Encode for the contexts as described in the OWASP XSS Prevention Cheat Sheet.