In cross-site scripting attacks, attackers insert attack scripts into your pages. Because no system is fool-proof, it may not be enough to screen the data that's submitted to an application. You should also escape any content sent to the user so that any malicious code that may have escaped your input screening is neutralized. Specifically, the characters crucial to forming HTML (``++&++``, ``++<++``, ``++>++``, ``++"++``, ``++'++``, and ``++/++``) must be escaped. 


This rule checks that values are not written directly into ``++application/json++`` blocks or JavaScript variables.


== Noncompliant Code Example

----
<script id="data" type="application/json">
  <%= data.json_payload %>  // Noncompliant
<script>

<script>
  var initialData = <%= data.json_payload =>;  // Noncompliant
</script>
----


== Compliant Solution

----
<script id="data" type="application/json">
  <c:out value="${data.json_payload}">  // by default, escapeXML="true" but it can also be specified explicitly
<script>

<script>
  var initialData = <%= escape_html(data.json_payload) =>;
</script>
----


== See

* https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md[OWASP XSS (Cross Site Scripting) Prevention Cheat Sheet]
* https://www.owasp.org/index.php/Top_10-2017_A7-Cross-Site_Scripting_(XSS)[OWASP Top 10 2017 Category A7] - Cross-Site Scripting (XSS)
* http://cwe.mitre.org/data/definitions/79[MITRE, CWE-79] - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
* http://cwe.mitre.org/data/definitions/352[MITRE, CWE-352] - Cross-Site Request Forgery (CSRF)
* https://www.sans.org/top25-software-errors/#cat1[SANS Top 25] - Insecure Interaction Between Components



ifdef::env-github,rspecator-view[]
'''
== Comments And Links
(visible only on this page)

include::comments-and-links.adoc[]
endif::env-github,rspecator-view[]
