Content interpreted as code.
WHAT IT IS
Submitted content displayed in a page and executed by the browser.
WHAT IT ALLOWS
Stealing sessions Acting as the visitor Modifying what people see
WHAT CAUSES IT
Outputting user-supplied content without escaping.
WHAT PREVENTS IT
Escaping everything displayed, according to where it appears.
WHAT FRAMEWORKS DO
Escape by default in templates.
WHAT TO CHECK
Where you have deliberately disabled that Content inserted by scripts Values placed into attributes and URLs
WHAT REQUIRES DIFFERENT TREATMENT
Content in markup Content in an attribute Content in a URL Content inside a script
Each needs its own escaping.
WHAT TO DO ABOUT USER-SUBMITTED FORMATTED CONTENT
Sanitise it with an established library, permitting only safe elements.
Never write your own filter.
WHAT ELSE HELPS
A content security policy, limiting what can execute.
WHAT NOT TO TRUST
Anything from a database, which was once input.
WHAT TO TEST
Submitting markup in every field and seeing whether it renders.
