Date validation passes for some xss vectors

Viewed 20

I am writing a test for a validator function which checks if a value passed is actually an instance of Date object or not. It returns either true or false. So if I pass a simple date, it passes as true that it is a safe value but now I am trying to test it by passing xss vectors (from this list) but somehow some of them returns true, like this one:

<SVg </onlOad ="1> (_=prompt,_(1)) "">

or this:

<svg contentScriptType=text/vbs><script>MsgBox+1

Why is this happening and how can I fix it to return false for xss vectors?

This is the validator function:

const isTimeSafe = (value) => {
    const datetime = new Date(value);

    return (datetime instanceof Date && !isNaN(datetime.valueOf()));
}

Here's the test spec:

it('should return false when isTimeSafe is called with xss vectors', () => {

    const vectors = fs.readFileSync(`xssVectors.txt`).toString().split('\n');
    
    for (vector of vectors) {
       const isSafe = isTimeSafe(vector);

       expect(isSafe).toBe(false);
    }

});


0 Answers
Related