Cross-Site Scripting (XSS) Detection

Cross-Site Scripting (XSS) Detection

You are performing a focused security assessment to find Cross-Site Scripting vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: recon (find sink sites), batched verify (trace taint for parallel batches of up to 3 sinks each), and merge (consolidate batch results into one report).

Prerequisites: sast/architecture.md must exist. Run the analysis skill first if it doesn't.

What is XSS

XSS occurs when user-supplied input is incorporated into a web page's HTML, JavaScript, or DOM without proper escaping or sanitization. This allows attackers to inject and execute arbitrary scripts in victims' browsers, leading to session hijacking, credential theft, defacement, and malware distribution.

The core pattern: unescaped, unsanitized user input reaches an HTML/JS output sink.

XSS Types

• Reflected XSS: User input is immediately echoed back in the HTTP response (e.g., a search term rendered directly into the page HTML).
• Stored XSS: User input is saved to persistent storage (database, file) and later rendered in HTML for other users.
• DOM-based XSS: Client-side JavaScript reads from an attacker-controlled source (location.search, location.hash, document.cookie) and writes to a dangerous DOM sink (innerHTML, eval, document.write) without server involvement.

What XSS IS

Server-side HTML sinks — rendering user data into HTML responses without escaping:

• Python/Jinja2: {{ var | safe }}, {% autoescape off %}...{{ var }}...{% endautoescape %}
• Python/Django: mark_safe(var), format_html(...) with %s and unescaped input, {{ var | safe }} in templates
• Python/Flask: Markup(var), render_template_string(f"...{var}...")
• PHP: echo $var, print $var, <?= $var ?> without htmlspecialchars()
• Ruby/Rails: raw(var), var.html_safe, <%= raw var %>, content_tag with .html_safe
• Java/JSP: <%= var %>, ${var} without <c:out> or fn:escapeXml()
• Java/Thymeleaf: th:utext="${var}" (unescaped), [(${var})]
• Go/html-template misuse: using template.HTML(var), template.JS(var), template.URL(var) to bypass auto-escaping
• C#/Razor: @Html.Raw(var), MvcHtmlString.Create(var)
• Node.js/EJS: <%- var %> (unescaped), vs <%= var %> (safe)
• Node.js/Handlebars: {{{ var }}} (triple-brace, unescaped)
• Node.js/Pug: !{var} (unescaped)
• Express: res.send("<html>..." + var + "..."), res.write("<p>" + var + "</p>")

Client-side DOM sinks — JavaScript writing user-controlled data to the DOM unsafely:

• element.innerHTML = var
• element.outerHTML = var