WebOTG-INJ-005 — Context-Aware Output Encoding & XSS Prevention

1. Executive Summary & Scope

Cross-Site Scripting (XSS) occurs when untrusted data is included in dynamic web pages without proper contextual escaping. When a victim views the page, the browser executes the malicious script in the victim's security context, enabling session hijacking, credential theft, and unauthorized transactions.

2. Threat Model & Attack Vectors

Attackers inject JavaScript payloads (``, `Characters `<, >, ", ', &` are fully converted to HTML entities and rendered harmlessly as text. Attribute Breakout Testing Submit attribute breakout payloads (`" onfocus="alert(1)`). Quotes are escaped to `"`, preventing attribute boundary breakout. CSP Header Verification Verify server delivers valid `Content-Security-Policy` header on all responses. Inline scripts without valid nonces are blocked by the browser.