135
cross-site scripting
also XSS
Untrusted text becomes HTML or script. Escape by default. `dangerouslySetInnerHTML` is a decision, not a convenience.
What is cross-site scripting?
XSS is an attacker’s string executing in a victim’s browser: stored in your database, reflected in a URL, or injected into a DOM API. The fix is contextual encoding and a content security policy, not a blocklist of `<script>`.
Why does cross-site scripting matter when vibe coding?
Models render markdown with raw HTML, or set `innerHTML` to a user name. The demo looks friendly. Name escape-by-default.
How do you do cross-site scripting?
Framework escaping stays on. If you must render HTML, sanitize with a real library and an allowlist. Never build HTML by concatenating strings. Put untrusted text in text nodes.
How do you ask a model for cross-site scripting?
Prevent XSS. Do not set innerHTML or dangerouslySetInnerHTML with user or markdown content unless it passes an allowlist sanitizer. Do not concatenate HTML. Keep framework escaping on.
What goes wrong with cross-site scripting?
Replacing `<` with nothing and calling it sanitizing. Encoding depends on context: HTML, attribute, URL, and JS are different.