But of course, anyone that actually wants to protect against XSS attacks won't allow user input to be evaluated. If they did want to allow user-supplied Javascript, they wouldn't blacklist, they would whitelist (by parsing the user-supplied script and using the AST to emit only whitelisted operations).
Comments
that weird behavior of javascript can actually be used for xss attacks, by being able to assemble strings. for example:
produces an "a".https://news.ycombinator.com/item?id=1153383
But of course, anyone that actually wants to protect against XSS attacks won't allow user input to be evaluated. If they did want to allow user-supplied Javascript, they wouldn't blacklist, they would whitelist (by parsing the user-supplied script and using the AST to emit only whitelisted operations).