# Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

**Stack:** Python

- Prevalence: 높음 자주 악용됨
- Impact: 치명적 1개의 치명적 심각도 규칙
- Prevention: 문서화됨 4개의 수정 예시

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

Cross-site scripting (XSS) vulnerabilities occur when untrusted data enters a web application and is sent to a web browser without proper validation or encoding. XSS allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

## Prevention

1개의 Shoulder 탐지 규칙을 기반으로 한 Cross-Site Scripting (XSS) 예방 전략.

### Python

Use template rendering with auto-escaping or html.escape() for manual escaping

## Warning Signs

- [HIGH] untrusted user input being rendered in HTML responses without proper
escaping

## Consequences

- 승인되지 않은 코드 실행
- 보호 메커니즘 우회
- 애플리케이션 데이터 읽기
- 애플리케이션 데이터 수정

## Mitigations

- 이러한 약점을 허용하지 않는 검증된 라이브러리나 프레임워크를 사용하세요
- 데이터가 사용될 컨텍스트와 기대되는 인코딩을 이해하세요
- 영향을 완화하기 위해 Content Security Policy(CSP)를 사용하세요

## Detection

- Total rules: 4
- Critical: 1
- Languages: javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **Cross-Site Scripting (XSS) in Templates** [HIGH]: Detects untrusted user input being rendered in HTML responses without proper
escaping.
  - Remediation: Use template rendering with auto-escaping, or escape manually with html.escape().

```python
import html
safe_text = html.escape(user_input)
```

Learn more: https://shoulder.dev/learn/python/cwe-79/xss