JSFiddle - React, Tailwind, and code Playground

by Hugo Licon

HTML

Vulnerability.create(alias: "xss", name: "XSS", description: "Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other
configuration. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by
Symantec as of 2007.", prevention: "
<p>Preventing XSS requires separation of untrusted data from active browser content.</p>
<ul>
  <li>Use safer frameworks that automatically escape for XSS by design, such as in Ruby 3.0 or React JS.</li>
  <li>Escaping untrusted HTTP request data based on the context in the HTML output (body, attribute, JavaScript, CSS, or URL) will resolve Reflected and Stored XSS vulnerabilities. The OWASP XSS Prevention Cheat Sheet has details on the required data escaping
    techniques.</li>
  <li>Applying context sensitive encoding when modifying the browser document on the client side acts against DOM XSS. When this cannot be avoided, similar context sensitive escaping techniques can be applied to browser APIs as described in the OWASP DOM
    based XSS Prevention Cheat Sheet.</li>
  <li>Enabling a Content Security Policy (CSP) is a defense in depth mitigating control against XSS, assuming no other vulnerabilities exist that would allow placing malicious code via local file include such as path traversal overwrites, or vulnerable libraries
    in permitted sources, such as content delivery network or local libraries.</li>
</ul>") 
Vulnerability.create(alias: "blindsqli", name: "Blind SQL Injection", description: "Blind SQL (Structured Query Language) injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the applications response. This attack is often used when the web...