Is window.location = example.com?q=<user input> susceptible to XSS?

jakejgordon_68905 0
Viewed 133

Let's say I have the following code:

//--get the value that was passed in via a query string parameter
var passedInQueryStringValue = getQueryStringValueFor("someKey");
//--append the value to the window.location as such:
window.location = "https://example.com?q=" + passedInQueryStringValue ;

Is this susceptible to XSS (or any other attack for that matter)? Let's assume that example.com properly handled whatever value for q gets sent over as that isn't the part I'm interested in here.

Something feels fishy here but I'm not positive there is a vulnerability.

xss javascript
2 Answers

That all depends on what example.com does with the querystring q

user_16791260

Per Adrian and @GuyT, this code is safe and is not susceptible to XSS or code injection.

example.com must of course not do anything silly with the value of q (like print it out as HTML) - but that's not what this question is about.

jakejgordon_689050
Related