Cross-site Scripting
Description
Cross-Site Scripting (XSS) is a client-side injection vulnerability that allows attackers to inject malicious scripts into trusted web applications. This occurs when applications include untrusted data in web pages without proper validation or encoding, causing browsers to execute attacker-controlled code in the context of the vulnerable site. XSS vulnerabilities can affect any web application that displays user input without adequate sanitization.
Remediation
Implement defense-in-depth measures to prevent XSS vulnerabilities:
1. Output Encoding: Apply context-appropriate encoding to all user-controlled data before rendering it in HTML, JavaScript, CSS, or URL contexts. Use established encoding libraries specific to your framework.
HTML Context Example:
// Encode user input before inserting into HTML
String safe = HtmlUtils.htmlEscape(userInput);
response.getWriter().write("<div>" + safe + "</div>");JavaScript Context Example:
// Use JSON encoding for data in JavaScript
String jsonSafe = JSONObject.quote(userInput);
out.write("<script>var data = " + jsonSafe + ";</script>");2. Input Validation: Validate all user input against strict allowlists of expected formats, lengths, and character sets. Reject invalid input rather than attempting to sanitize it.
3. Content Security Policy (CSP): Implement a strict CSP header to prevent inline script execution and restrict script sources to trusted domains:
Content-Security-Policy: default-src 'self'; script-src 'self' trusted-cdn.com
4. Use Security Headers: Enable X-XSS-Protection and X-Content-Type-Options headers as additional defense layers.
5. Framework Protection: Utilize auto-escaping template engines and framework-provided XSS protection features (e.g., React's JSX, Angular's sanitization).