flawopen.com/クロスサイトスクリプティング/Javascript
Imagine a guestbook where a visitor writes a note containing hidden script tags that execute in the browser of the next person who opens the page.
Cross-site scripting happens when untrusted user input is inserted into the DOM without proper HTML output encoding.
In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.
Documented historical AppSec case study.// comment text parsed directly as HTML
function renderComment(el, comment) {
el.innerHTML =
`${comment}
`;
}
// comment text inserted as safe plain text
function renderComment(el, comment) {
const p = document.createElement('p');
p.textContent = comment;
el.appendChild(p);
}
textContent inserts values strictly as plain text, preventing the browser from parsing markup into executable elements.
Explicitly disables React auto-escaping. Must be paired with DOMPurify if used.
Template escape hatches and direct DOM APIs (innerHTML, outerHTML) bypass framework defenses.
grep -rn "\.innerHTML\s*=" --include="*.js" --include="*.ts" .
grep -rn "dangerouslySetInnerHTML" --include="*.jsx" --include="*.tsx" .
react/no-danger and DOMPurify for cases where HTML formatting is genuinely required.No. CSP provides defense-in-depth, but output encoding remains the primary defense.