xss
Safeguard articles tagged "xss" — guides, analysis, and best practices for software supply chain and application security.
86 articles
node-html-parser: How to Parse HTML Safely in Node.js
node-html-parser is a fast, dependency-light HTML parser for Node.js. Here is how to use it without opening the door to injection or denial-of-service bugs.
JavaScript Injection Attacks: Types and Prevention
JavaScript injection covers a family of attacks where untrusted input becomes executable code or markup in the browser. Here are the types and the concrete defenses for each.
Stored XSS Explained: A Security Guide
Stored XSS is the persistent, high-impact form of cross-site scripting where a malicious script is saved server-side and served to every visitor. Here is how to detect and stop it.
PHP Application Security: A Practical Guide to Locking Down Your Code
PHP application security comes down to a handful of high-impact controls. Here is how to handle injection, sessions, uploads, and dependencies without the theory.
JavaScript Injection Attack: How It Works and How to Stop It
A JavaScript injection attack runs attacker-controlled script in a victim's browser or a Node.js process. Here is how the attack class works and the defenses that actually neutralize it.
What jQuery Migrate Is and How to Use It Securely
jQuery Migrate helps older code survive newer jQuery releases, but leaning on it can quietly keep you on a vulnerable jQuery version. Here is how to use it without inheriting old XSS bugs.
jQuery Validation: A Security Guide to XSS and ReDoS Risks
The jQuery Validation plugin is convenient, but client-side validation is not a security control. Here is where jquery validation has been vulnerable and how to use it safely.
npm rollup: A Security Review and Safe Usage Guide
A practical look at what installing rollup from npm means for your supply chain, the DOM clobbering XSS bug you should know about, and how to pin a safe version.
Is react-json-view Safe to Use? A Security Guide
The original react-json-view package is popular but unmaintained. Here is what that means for your app's security and which fork to move to.
Is swagger-ui-react Safe? A Security Guide for React API Docs
swagger-ui-react has no known direct CVEs, but its real risk lives in a deep dependency tree. Here is how to embed it without inheriting a transitive XSS.
org.owasp.esapi: What the OWASP ESAPI Library Is and How to Use It Safely
org.owasp.esapi is the Maven coordinate for OWASP ESAPI, a Java security control library. Here is what it does, where it still helps, and the CVEs to watch.
Bootstrap 4.3.1 and 4.4.1 Vulnerabilities: Audit and Upgrade Guide
What your scanner means when it flags bootstrap 4.3.1 vulnerabilities: the real advisories, the withdrawn one, the jQuery 3.4.1 problem next to it, and a sane upgrade path.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.