XSS Filters: Beating Length Limits Using Shortened Payloads - Port Swigger
Summary: PortSwigger Research describes how attackers beat XSS filters that truncate input to a fixed maximum length by shortening payloads with the shortest available JavaScript APIs and by removing unnecessary characters. A second technique stores a larger JavaScript payload in the window.name property from a site the attacker controls, then executes it on the vulnerable site with eval(window.name), shortened to eval(name), typically by using a hidden iframe that sets the payload and redirects the iframed window to the target page.
Key Takeaway: A length limit on input is not a defense: an attacker can park a full payload in window.name from their own site and run it on yours with a nine-character eval(name), so the filter never sees the code it is meant to block.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026