Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

This lab isolates Reflected JSON-to-eval DOM XSS. /search-results?search= reflects input in JSON and client code evaluates the complete response with eval(responseText). The server escapes the quote but not the preceding backslash, so the backslash neutralizes that escape, closes the string, and comments the JSON remainder.

Lab objective/setup

Open the Academy exercise at the reserved lab URL and work only in that disposable environment. The required proof is specific: Evaluation reaches alert(1) and the lab reports success.

What I observed

/search-results?search= reflects input in JSON and client code evaluates the complete response with eval(responseText). The server escapes the quote but not the preceding backslash, so the backslash neutralizes that escape, closes the string, and comments the JSON remainder.

Academy objective explains that a server response is processed unsafely by client JavaScript, creating reflected DOM XSS.
Academy objective explains that a server response is processed unsafely by client JavaScript, creating reflected DOM XSS.
JSON search response reflects an unencoded script string in `searchTerm`, showing the server-side source returned to the browser.
JSON search response reflects an unencoded script string in `searchTerm`, showing the server-side source returned to the browser.

Why it is vulnerable

The application applies protection for the wrong parser or omits a control at the decisive boundary. In this case, /search-results?search= reflects input in JSON and client code evaluates the complete response with eval(responseText). Browser parsing therefore preserves the attacker-controlled behavior instead of reducing the value to inert text or a safe URL.

Walkthrough in the authorized PortSwigger lab

First reproduce the recorded page or request and inspect the exact reflected, stored, or DOM-generated context described above. Then supply the following lab payload as data, not as active markup in this article:

1
`\"-alert(1)}//`

The server escapes the quote but not the preceding backslash, so the backslash neutralizes that escape, closes the string, and comments the JSON remainder.

Client code passes the complete response text to `eval` before calling `displaySearchResults`, making the JSON response an executable JavaScript sink.
Client code passes the complete response text to `eval` before calling `displaySearchResults`, making the JSON response an executable JavaScript sink.
Browser alert dialog showing `1` after a backslash defeats quote escaping and the evaluated response executes the injected expression.
Browser alert dialog showing `1` after a backslash defeats quote escaping and the evaluated response executes the injected expression.

Verification

Evaluation reaches alert(1) and the lab reports success. This distinguishes execution from a payload merely appearing in source or being stored without reaching the required event or sink.

Impact and defensive lesson

In a real application, equivalent XSS could act with the victim’s same-origin privileges, expose readable data, or perform authenticated actions. Fix the data flow at its context: use text-only DOM APIs, JavaScript- or attribute-aware encoding, strict URL-scheme allowlists, and maintained sanitization where HTML is unavoidable. HttpOnly cookies and a restrictive CSP reduce consequences but do not repair the injection flaw.

References