CWE-87: Improper Neutralization of Alternate XSS Syntax
Description
The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Example - 1
In the following example, an XSS neutralization method intends to replace script tags in user-supplied input with a safe equivalent: The code only works when the "script" tag is in all lower-case, forming an incomplete denylist (CWE-184). Equivalent tags such as "SCRIPT" or "ScRiPt" will not be neutralized by this method, allowing an XSS attack.return input.replaceAll("script", mask);public String preventXSS(String input, String mask) {}
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.