XSS without parentheses and semi-colons
Summary: PortSwigger researcher Gareth Heyes documented techniques for calling JavaScript functions without parentheses or semi-colons, using the onerror handler and throw statement, such as <script>{onerror=alert}throw 1337</script>. He also showed a Firefox-specific workaround using an object literal with Error properties (lineNumber, columnNumber, fileName, message), with follow-up vectors from @terjanq and Pepe Vila that removed string literals and the throw statement entirely.
Key Takeaway: Filtering parentheses and semi-colons is a common defense against XSS, and this research shows it can be bypassed with block statements, throw expressions, and type errors - so a filter that blocks those two characters alone does not stop script execution.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026