​Is it necessary to remove '#' special character in XSS filter?

[former_member628981]

Dear Experts.

Is it necessary to remove '#' special character(\u0023, Number sign, Hash mark) in XSS filter?

Is there any reason to remove '#' from XSS filter?

I found that this rule is removing '#'.

xss.filter.rule.javascript2=(?i)\\u0023

Other rules remove '<', '>' characters already, and prevent javascript xss attack. nevertheless, Is it necessary to remove '#' special character additionaly?

Any Pointers will be helpful.

Thank you for taking the time to read this thread.

[former_member634920]

Hello,

It should stay enabled due OWASP compliance https://blog.appsecco.com/automating-discovery-and-exploiting-dom-client-xss-vulnerabilities-using-s...

You can create your own XSS Filter with corresponding XSSValueTranslator to add some custom logic if needed

Regards,

Mykhailo