Skip to content

Cross-Site Scripting (XSS) via Unvalidated User Input

Description

This application accepts user input directly from the client side without validation, which could lead to Cross Site Scripting (XSS) if the input contains malicious script code and the application server does not properly escape or sanitize the output.

Examples

Insecure Code

javascript
router.get('/unsafe', (req, res) => { res.send(req.query.name); })

Secure Code

javascript
router.get('/safe', (req, res) => { var name = encodeURI(req.query.name); res.send(name); })

Remediation

Encode input data before sending it to the client side using functions like encodeURI() or encodeURIComponent().

Rule Details

FieldValue
IDCODE-0427
CategoryWeb
SeverityMEDIUM
CWECWE-79
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
TagsXSS, Cross-Site Scripting
OWASPA7:2017-Cross-Site Scripting (XSS), A03:2021-Injection