Cross-Site Scripting (XSS)

• Attacker data runs as code in the victim's browser
• Runs with the page's origin: reads DOM, sends requests, acts as the user

• Sources: location.hash, location.search, document.referrer, postMessage
• Sinks: innerHTML, document.write, eval, setTimeout(string), element.href
• location.hash, postMessage skip the server; location.search is sent

• Never reaches the server? DOM XSS via #fragment; grep for sources and sinks
• Stored worse? No crafted link; hits every viewer
• Sources, sinks? location.hash, postMessage; innerHTML, eval

• Encode on output, for the exact context where the data lands
• Input validation is defence in depth, not the fix
• Each context has its own encoder

• Unquoted attribute: a space breaks out, x onmouseover=alert(1)
• HTML entities do not stop a javascript: href
• HTML-escaping a value placed in <script> is the wrong encoder

• Response header listing allowed script sources
• Limits damage when an escaping bug slips through
• Not a replacement for output encoding

Content-Security-Policy: default-src 'self';
  script-src 'nonce-R4nd0m' 'strict-dynamic';
  object-src 'none'; base-uri 'none'

nonce: fresh per response, unguessable

• Inline event handlers are blocked unless allowed
• Roll out with Content-Security-Policy-Report-Only + report-to

• HttpOnly hides the session cookie from document.cookie
• Add Secure and SameSite=Lax or Strict
• Does NOT stop XSS sending authenticated requests as the user

• HttpOnly? Stops cookie theft, not in-page requests as the user
• Nonce vs allowlist? Allowed hosts can serve usable scripts; a nonce trusts only your tags
• Deploy safely? Report-Only, fix reports, then enforce

• Escaped by default: JSX, Angular, Vue {{ }}, Django, Rails
• Jinja2 only with autoescape on (Flask does for .html)

• Allowlist sanitiser: DOMPurify (client) or a server-side equivalent
• Run it immediately before rendering
• Never write your own regex filter

• href/src with javascript: URLs
• style and event-handler attributes
• Server-side template injection
• Direct DOM writes: ref.innerHTML

• Three hatches, fixes? v-html, |safe, mark_safe: use default {{ }} escaping
• Why is <a href={userUrl}> risky? React 18 and earlier run javascript: on click; React 19 blocks it, still allowlist
• Sanitiser instead of encoding? When users must supply real HTML

• innerHTML, document.write parse markup
• textContent, innerText never do

el.innerHTML = userText;   // parses markup
el.textContent = userText; // plain text

one-line fix

• HttpOnly alone: XSS still sends requests as the user
• CSP alone: it is only a second layer
• 'unsafe-inline' with no nonce or hash: injected inline script runs

• Why does a blacklist fail? Too many tags, events and case tricks; allowlist instead.
• Fix for innerHTML with user text? Use textContent.
• Which mistake makes CSP useless? 'unsafe-inline' without a nonce or hash.

• Comment box? Escape on output, sanitise rich HTML, nonce CSP, HttpOnly cookie
• Stop and miss? Escaping misses hatches; CSP and HttpOnly contain, they do not stop requests
• Audit? Grep sinks, trace sources to them, check CSP for unsafe-inline