Is use of the ASP.Net Request.QueryString safe in JavaScript?

Question

Consider the following code:

function redirect() {
    window.location = "../../index.aspx?<%=Request.QueryString%>";
}

Is this code safe or can it be exploited by an XSS attack?

If so:

1. How?
2. How to prevent it?

Answer 1

Consider this as a querystring:

Xx"; alert('pwned'); window.location ="whatever

Basically, you are allowing completely arbitrary JavaScript to be injected.

Best solution: never take direct user input and use it this way.

Second best solution: encode it for use in a JavaScript string before using it there. A simple " breaks out here.

Also; do not mistakenly do HTML encoding for this. That won't work right and will still be vulnerable.