7. Cross-site scripting (XSS)
A web application includes untrusted data in a new web page without proper validation.
What it is
XSS allows malicious code to be added to a web page or app (e.g., via user comments or form submissions used to define the subsequent action). Since HTML mixes control statements, formatting, and requested content into the web page’s source code, it allows an opportunity for unsanitized code to be used in the resulting page. XSS is the second most prevalent issue in the OWASP Top 10 and is found in around two-thirds of all applications.
How it works
When a web page or app utilizes user-entered content as part of a resulting page without checking for bad input, a malicious user could enter content that includes HTML entities.
Why it’s bad
Attackers can change the behavior of an app, direct data to their systems, and corrupt or overwrite existing data.
Use frameworks that automatically escape XSS by design. Learn the limitations of each framework's XSS protection and appropriately handle the use cases which are not covered.
Apply context-sensitive encoding when modifying the browser document on the client side acts against DOM XSS.
Enable a Content Security Policy (CSP) against XSS. It is effective if no other vulnerabilities exist that allow placing a malicious code file (e.g., compromised CDN, an unsecured file system on the server).
XSS example 1
Reflected XSS: The application or API includes unvalidated and unescaped user input as part of HTML output.
XSS example 2
Stored XSS: Often considered a high or critical risk, the application or API stores unsanitized user input that is viewed later by another user or an administrator.
XSS example 3