XSS
acronymweb devsecurity
Stands for: Cross-Site Scripting
An attack that injects malicious script into a web page so it runs in other users' browsers.
Cross-Site Scripting exploits a page that reflects or stores untrusted input without escaping it, letting an attacker's JavaScript run with the victim's session. Output encoding and a Content Security Policy are the standard defences; it is a perennial OWASP Top 10 entry.
Cross-site scripting is the browser executing attacker-supplied script in the context of a site the user trusts, which means it inherits that site's cookies, session and permissions. The three shapes are stored, where the payload is saved and served to every visitor, reflected, where it rides in a request and comes back in the response, and DOM-based, where the page's own JavaScript writes untrusted data into a dangerous sink and the server never sees it.
The defence is contextual output encoding rather than input filtering, because the same string is safe in HTML text, dangerous in an attribute and differently dangerous inside a script block. Blocklists of tags and keywords fail because the encoding surface is enormous. Content Security Policy is the useful second layer, and it only works if the page is not already using unsafe-inline, which is the setting that removes the protection.
Also known as: xss, cross-site scripting, cross site scripting