XSS

Cross-site scripting persists because context, parser, and framework edges are complex. Treat every user-influenced string as untrusted until it is strictly encoded for the exact sink and guarded by runtime policy (CSP/Trusted Types).

Attack Surface

Types

• Reflected, stored, and DOM-based XSS across web/mobile/desktop shells

Contexts

• HTML, attribute, URL, JS, CSS, SVG/MathML, Markdown, PDF

Frameworks

• React/Vue/Angular/Svelte sinks, template engines, SSR/ISR

Defenses to Bypass

• CSP/Trusted Types, DOMPurify, framework auto-escaping

Injection Points