Cross-Site Scripting (XSS)

• XSS converts a stored comment, a search echo, or a URL fragment into full session theft and keystroke capture.
• It is the sneakiest top-tier bug: the target audience is other users, not the database.
• Learning the three flavors (reflected, stored, DOM) generalizes to every templating engine you will ever use.

The book was meant for words; someone pasted instructions the future readers would execute.

• Reflected: input is printed unescaped in the response (search echo), attacker lures the victim via the crafted link.
• Stored: the payload is saved in the app (comment/profile) and rendered to every subsequent visitor — the most damaging.
• DOM XSS: the client-side JS reads a location/source and writes it into innerHTML without a sink guard.
• Same-origin policy is the fence; XSS hops it because the code executes within the honest origin's trust boundary.

• A SaaS team enforces a 'encode-on-output' rule in every template, so even user-entered HTML is inert by default.
• A bank deploys a strict CSP that blocks inline scripts, making even a successful injection hard to weaponize.
• A bug bounty program rewards a report of stored XSS in a syntax highlighter; the fix ships as library pinning + escaping.

• Encode output by context: HTML-encode text nodes, attribute-encode attributes, and JS-encode in script contexts.
• Prefer safe frameworks/building patterns that auto-escape (React, Vue templates, Rails erb) over innerHTML surgery.
• Add a strict Content-Security-Policy (no inline scripts, source allow-lists) as depth, not as a replacement for encoding.
• Treat any sink (innerHTML, document.write, eval) as a code-review checkpoint.

• Thinking 'I block <script>' is enough — payloads ride in event handlers, img src, and URL schemes.
• Escaping only the keyword in the middle of the string and leaving the surrounding HTML mechanics unguarded.
• Trusting 'the sanitizer library' forever without a critical-update process for it.
• Assuming innerHTML use in a React-incompatible widget escaped review because 'the app is modern'.

• To triage quickly, echo input verbatim in a <textarea> and see whether it 'emerges' raw in the returned HTML.
• Browser devtools > Sources is your friend: break on the sink (innerHTML) to confirm DOM-XSS path.
• Test whether a pasted <img onerror=...> executes in a sandboxed viewer with JS disabled before enabling it.

• Only verify XSS inside your own lab/own accounts; injecting scripts that affect real users is a crime, not a test.
• A stored XSS is also a data-processing event: keep logs of the test so forensics know your footprint.
• Pair XSS defense with session hardening (HttpOnly, Secure flags, SameSite) to cap the value of any theft.