Is it safe to pre-check for a potential XSS attack by testing for "<"?

Viewed 54

Let's assume we want to write a function that checks input parameters for a potential XSS attack (code is written in Python, but you get the idea):

def is_potential_xss(s):
    assert type(s) is str

    if not "<" in s:
        # pre-check: it cannot be a HTML fragment
        return False
    # ... 
    # do a sophisticated, but slow, parsing of the string to detect
    # malicious tags or attributes.
    ...

So here's my question:

Can I safely assume that any html tag must contain a literal "<", e.g. <script> or are there other representations that a browser would interpret and execute? For example &#60;script> would not be executed afaik.

Edit: As @tobias-k noted, XSS would be possible with strings that don't contain <, when inserted in a special context like a tag attribute. However this question is about html fragments that are rendered as html node.

0 Answers
Related