aegis-web-client

Scope & Objectives

In Scope

• XSS in all three flavors: reflected (server echoes input), stored (input persisted then rendered to other users), DOM-based (client-side JS moves data from source to sink without a safe encoding step).
• Server-side template autoescaping bypasses (|safe, mark_safe, {!! !!}, raw, <%-, @Html.Raw, th:utext).
• Context-aware output-encoding review: HTML body, attributes, JS strings, URLs/hrefs, CSS.
• Mutation XSS (mXSS) triage at re-parsing sinks.
• CSP strength evaluation as a mitigating control.
• CSRF: token presence/validation across frameworks, state-changing GETs, JSON/content-type-only guards, SameSite analysis, custom-method validation gaps, login/logout CSRF.
• Clickjacking on sensitive pages via X-Frame-Options / frame-ancestors.
• Cross-origin pitfalls: postMessage handler origin/data validation; CORS-with-credentials reflection (deep config detail lives in the CONFIG module — cross-reference it, do not duplicate deeply).
• Client-side storage misuse: tokens/secrets/PII in localStorage/sessionStorage, password-field autocomplete.
• DOM clobbering gadgets and client-side open redirect via location manipulation (server-side redirects belong to the SSRF module).
• Client-side template injection: AngularJS $compile, Vue runtime templates, Handlebars/Mustache/lodash compile-from-string.
• Post-authentication stored dangers: admin-panel field rendering, filename rendering (SVG upload payload delivery is covered by the FILE module).
• Subresource Integrity: every <script src>/<link rel=stylesheet> pointing at third-party origins carries integrity="sha384-..." + crossorigin; a compromised CDN must not become script execution. Missing SRI on vendor assets = flag (first-party same-origin assets exempt).