XSS

Vulnerabilities such as SQL injection, XSS, and SSRF have long occupied the OWASP Top 10 security risk list.

A WAF (Web Application Firewall) is a security device or software deployed in front of web servers that intercepts known attack patterns by inspecting the characteristics of HTTP requests.

Common entry-level directions for SRC include medium- and low-risk vulnerabilities such as information disclosure, unauthorized access, XSS and SSRF; these vulnerabilities have low tool dependence and clear verification paths, making them suitable as practice targets.

Input validation is used to prevent attacks such as SQL injection and cross-site scripting (XSS), and the principle is to trust no data from the client side.

The LaTeX renderer uses an <iframe sandbox> mechanism to defend against XSS risks, layered with DOMPurify for HTML sanitization.

If model output is rendered as HTML by the application, there is an XSS risk; if it is used to concatenate queries or shell commands, there is an injection risk, so model output should be treated as untrusted user input.

Cross-site scripting (XSS) is the injection of malicious JavaScript into a page; when other users browse that page the script executes in their browser and can steal cookies or session tokens.

XSS (Cross-Site Scripting) is when a page renders user input directly as HTML, causing malicious scripts to execute in other people's browsers; it is divided into reflected, stored, and DOM types.

HttpOnly cookies can prevent JavaScript from reading session tokens, and are an effective measure against XSS session theft.

React's JSX rendering automatically escapes strings before inserting them into the DOM, thereby eliminating most traditional XSS attack paths.

Using dangerouslySetInnerHTML in React bypasses the automatic escaping mechanism, leaving the developer fully responsible for content sanitization, and it is a common entry point for XSS.

The CSP response header, by restricting script source domains and inline script execution, can prevent malicious code from running when XSS injection occurs, and is the second line of defense for React applications.

If the refresh token is placed in localStorage, an XSS occurrence is equivalent to account compromise.

If LLM output is rendered or executed without encoding, it can lead to XSS (when rendered as HTML/Markdown), SQL injection (when concatenated into database queries), and SSRF (when URLs are included for backend fetching).

Blindly injecting large numbers of payloads will trigger WAFs and cause the IP to be blocked, making it impossible to detect vulnerabilities even if they exist in the target.

A good XSS detection Skill should adopt a layered process of reconnaissance before escalation: first check whether the Content-Type is text/html, test reflection with a unique marker, inject HTML first to determine HTML injection, and then escalate step by step to XSS.

Tokens stored in memory are lost after a page refresh, but are more secure because XSS attacks cannot read them via document.cookie or localStorage

Tokens stored in localStorage can persist after a tab is closed, but are exposed to XSS risks

Storing JWT in HTTP-only cookies prevents client-side JavaScript from reading the token, thereby defending against XSS attacks that steal authentication credentials.

Pattern-based vulnerabilities such as SQL injection and XSS have clear characteristics and relatively standardized remediation approaches that AI models can learn through training data.