I am using Google Chrome version 98 for this.
I've noticed that when I have a window.prompt and I input <script>, it returns a string with the value of \x3Cscript> instead of <script>. This is odd to me because if I just input <, then it returns <. Only when I input <script> does it change the first angle bracket to its hex code; inputting <a> returns <a>, even inputting <scrip returns <scrip. What I am asking is, does the Javascript engine inside a browser do this parsing internally to prevent injecting Javascript? How does the window.prompt function work internally? I've tried searching for how window.prompt works and could not find anything related to this.
EDIT: I ask this question because I originally was testing out writing a cookie based on user input, and then making a greeting based on the cookie value. Here is the code:
const header = document.getElementById('survey-header');
if (document.cookie.split(';').some(item => item.trim().startsWith('name='))) {
name = document.cookie
.split('; ')
.find(row => row.startsWith('name='))
.split('=')[1];
} else {
name = window.prompt('Please enter your name', 'User');
document.cookie = 'name=' + name
}
/* Set header to greeting message */
header.textContent = 'Greetings, ' + name
But I noticed that when I try to inject Javascript into the prompt, the header is displayed as Greetings, \x3Cscript>...</script>. That made me curious why only some angle brackets are displayed as their hex code.
There are a few differences between regular script execution and the "chrome console"/REPL. Regular scripts are executed by a JavaScript engine that conforms to the JavaScript (EcmaScript) specification, so the way different JavaScript engines behave is standardized. The chrome console on the other hand is free to have some special quirks and rules that it implements that don't necessarily follow the JavaScript spec. As a result, you'll find that some things behave slightly differently in the chrome console compared to how they would behave in a standard script (see here for another example).
In your case, the behavior you're seeing is specific to Chrome's console and isn't something that is done because it is specified in the JavaScript specification. The feature instead comes from a design decision made by the Chrome dev-tools team. The output you see is an escaped version of the string "<script>", which is done to enable users to safely copy outputs from the Chrome console into their own HTML code. This is outlined as part of the design goals for how the chrome console displays strings:
Design goals
We want to improve the readability of the displayed strings, while continuing to output valid JavaScript literals. To ensure security for our users, we should escape "<!--", "<script", and "</script" such that the resulting string can safely be copied into tags within HTML.
(their emphasis)
If you're curious, you can see how this is implemented here.
Because this behavior is specific to Chrome's console, regular JavaScript engines won't sanitize your user inputs - it is still up to you to use the appropriate DOM methods (such as .innerText, .textContent, etc.) and string sanitization methods for managing and displaying your user inputs securely. If you enter <script>alert(1);</script> in the input below, you'll find that your string is not escaped and can still cause securtity issues:
const userInput = prompt("Enter XSS code:");
document.write(userInput);