CME-1306

XSS Prevention (Context-Aware Output Encoding)

Harden Application Unquantified evidence Preventive

Description

Application applies context-aware output encoding to every untrusted value immediately before it reaches an HTML text, HTML attribute, JavaScript, CSS, URL, SVG, or DOM insertion context. The encoder is selected for the final parser context; HTML escaping is not used as a substitute for JavaScript, CSS, URL, or attribute encoding. Framework auto-escaping (such as Django or Jinja2 autoescape and React JSX) is enabled for production templates. Raw or safe rendering APIs, dangerouslySetInnerHTML, innerHTML, document.write, and equivalent DOM sinks are prohibited or independently reviewed and sanitized. This control prevents attacker input from being interpreted as executable markup or script. CSP in CME-905 provides browser-enforced defense in depth, while WAF filtering in CME-904 is probabilistic defense in depth.

CVSS Vector Impacts

Metric	Transition	Rationale
Integrity (I)	H → L	When every untrusted value is encoded for its final output context and dangerous rendering sinks are prohibited or sanitized, attacker input cannot inject script that changes page behavior or performs actions with the victim's authority. Low integrity impact remains possible through the application's intended state-changing operations. This attenuation requires complete source-to-sink coverage, context-correct encoding at insertion time, and review of framework escape hatches and client-side DOM sinks.

CWE Relationships

CWE-79 CWE-116

Verification

Use framework-specific static analysis to trace untrusted values to every server-rendered and client-side sink. Verify that each sink uses the encoder required by its final HTML, attribute, JavaScript, CSS, URL, SVG, or DOM context; that production template auto-escaping is enabled; and that raw or safe rendering APIs, dangerouslySetInnerHTML, innerHTML, document.write, and equivalent sinks are prohibited or independently reviewed and sanitized. Pair source analysis with application-specific dynamic tests covering HTML text, quoted and unquoted attributes, JavaScript strings, CSS, URLs, SVG, DOM insertion, encoded payloads, and mutation-XSS cases. The audit and test commands must cover all production rendering components and emit the exact PASS strings below; set each environment variable to the project's corresponding audit or test command.

$ test -n "$CME_XSS_SOURCE_AUDIT_COMMAND" || { echo 'ERROR: set CME_XSS_SOURCE_AUDIT_COMMAND'; exit 2; }; output=$(sh -c "$CME_XSS_SOURCE_AUDIT_COMMAND") && test "$output" = 'PASS: all untrusted rendering sinks use context-correct encoding' && printf '%s\n' "$output"
# Expected: PASS: all untrusted rendering sinks use context-correct encoding

Platform: any

$ test -n "$CME_XSS_SERVER_TEST_COMMAND" || { echo 'ERROR: set CME_XSS_SERVER_TEST_COMMAND'; exit 2; }; output=$(sh -c "$CME_XSS_SERVER_TEST_COMMAND") && test "$output" = 'PASS: server-rendered XSS payloads render as inert data' && printf '%s\n' "$output"
# Expected: PASS: server-rendered XSS payloads render as inert data

Platform: any

$ test -n "$CME_XSS_CLIENT_TEST_COMMAND" || { echo 'ERROR: set CME_XSS_CLIENT_TEST_COMMAND'; exit 2; }; output=$(sh -c "$CME_XSS_CLIENT_TEST_COMMAND") && test "$output" = 'PASS: client-side XSS payloads cannot reach executable DOM sinks' && printf '%s\n' "$output"
# Expected: PASS: client-side XSS payloads cannot reach executable DOM sinks

Platform: any