flawopen.com/xss-c/Cpp
💡 Plain English Explainer (ELI5)
Imagine a guestbook where visitors write a public note. Stored XSS is like someone writing a note that isn't just text — it's a hidden trick that makes the guestbook page itself start doing things, like stealing the next visitor's login session, the moment anyone opens the page to read it.
Core Concepts & Subsystem Terms
- output encoding
- Converting characters that have special meaning in HTML (like < and >) into harmless equivalents before inserting untrusted text into a page, so the browser displays it as text instead of running it as markup or script.
- DOM
- The in-memory tree structure a browser builds from a page's HTML — where an element's innerHTML is set determines whether inserted content is rendered as inert text or executable markup.
Step-by-Step Attack Flow
Source Code: Flaw vs. Secure Implementation
✕ UNPATCHED FLAW
/* comment text written with no encoding */
fprintf(response,
"<div>%s</div>", comment_text);
✓ HARDENED SECURE PATCH
/* encode before insertion */
char *encoded = html_encode(comment_text);
fprintf(response,
"<div>%s</div>", encoded);
free(encoded);
Engineering & System Hardening Checklist
- ✓HTML-encode every value before inserting it into generated markup — never write it raw
- ✓Use a maintained encoding library rather than a hand-rolled one where possible
- ✓Treat CGI environment variables as untrusted input, same as parsed request parameters
- ✓Address buffer-safety and encoding as two separate, both-required fixes
References