Cross-site scripting (XSS)
In XSS, external content becomes executable code in the browser. The key issue is how an application inserts input into its pages.
Cross-site scripting, or XSS, is an attack in which external code runs in the browser in the context of an affected website. The application inserts untrusted data into a page in a way that makes the browser treat it as executable content. The code can, for example, alter the displayed page or make requests with the signed-in person's permissions.
A comment in a project portal
A fictional project portal stores comments in the noteText field and later shows them to other team members. The field is intended for ordinary text. If its content is inserted as HTML without appropriate checks, specially crafted input can inject executable content. Storing a comment in your own database does not make it trustworthy for later output. Values from connected systems must also be handled appropriately for where they are rendered.
If the comment should be text only, the application uses a suitable text output mechanism or its framework's safe default rendering. If formatted HTML is deliberately allowed, it needs a maintained sanitisation solution with defined permitted content.
The output context determines the protection
MDN and OWASP distinguish handling for text, HTML, attributes and other output contexts. Encoding suitable for ordinary HTML text is not universal protection for JavaScript or URLs. Input validation alone does not replace protection at output.
A Content Security Policy can additionally restrict which code runs. It replaces neither safe output locations nor necessary HTML sanitisation. The portal scenario illustrates that distinction; it does not describe a security test that was performed.
Sources
Related terms
- FrontendThe frontend is an application’s user-facing interface. Helpful browser feedback does not replace authoritative server-side checks.
- JavaScriptJavaScript is a programming language for application logic, in browsers and elsewhere. Its role differs from HTML and CSS.
- HTMLHTML describes the structure and meaning of web content. It identifies elements such as headings, tables and input fields.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Envelope encryptionEnvelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.