Javascript

XSS in URL parameters URL parameters are one of the most common places where XSS starts. They feel harmless because they arrive as plain text: https://example.com/search?q=shoes Then somebody reads q, drops it into the page, and now you have script execution. The vulnerable pattern is usually boring: const params = new URLSearchParams(window.location.search); const q = params.get('q'); document.getElementById('search-label').innerHTML = `Results for: ${q}`; If q is: <img src=x onerror=alert(1)> you just handed the browser executable HTML. ...

Excel web add-ins are just web apps wearing an Office badge. That sounds obvious, but teams forget it all the time. I’ve seen this play out the same way more than once: a team builds a task pane add-in, treats workbook data like “internal content,” renders it into the DOM, and accidentally creates a clean XSS path inside Excel. The UI looks harmless. The payload comes from a spreadsheet cell, a custom function result, or a document setting. Then somebody pastes attacker-controlled content into a workbook, shares it, and the add-in executes script in the task pane. ...

Tauri gives you a desktop shell with a web frontend, which is exactly why XSS in a Tauri app is more dangerous than XSS in a normal website. A browser XSS bug usually means session theft, UI redress, or requests made as the user. A Tauri XSS bug can become local file access, unsafe command execution through Rust commands, abuse of privileged APIs, or persistence inside a desktop app users trust more than a random tab. I’ve seen teams treat the frontend like “just a local UI” and that mindset creates ugly bugs fast. ...

Content Security Policy nonces are one of the cleanest ways to shut down a huge class of XSS bugs without rewriting every frontend template you own. If you’ve ever inherited a server-rendered app with inline scripts sprinkled everywhere, nonces are usually the fastest path to meaningful protection. They let you keep specific inline <script> and <style> blocks while blocking attacker-injected ones. The short version: The server generates a fresh random nonce for every HTTP response That nonce goes into the CSP header The same nonce is added to trusted inline <script> or <style> tags The browser executes only the tags with the matching nonce If an attacker injects <script>alert(1)</script>, it won’t have the right nonce, so the browser refuses to run it. ...

n8n is great at moving data between systems fast. That also makes it great at moving attacker-controlled HTML and JavaScript straight into places you did not expect. If you build internal tools, approval flows, chat integrations, or webhook-driven automations with n8n, you are already handling untrusted input. The problem starts when that input gets rendered in a browser, embedded into HTML emails, dropped into dashboard widgets, or passed into a frontend without output encoding. ...

HTMX is great at making server-rendered apps feel fast without dragging in a giant frontend stack. I like it for exactly that reason. You keep your templates, keep your backend routing, and sprinkle interactivity where you need it. The catch: HTMX is built around fetching HTML and swapping it into the DOM. That’s the same territory where XSS thrives. If your app sends attacker-controlled HTML back to the browser, HTMX will happily insert it. That doesn’t make HTMX uniquely insecure. It just means the trust boundary is very clear: HTMX amplifies whatever your server returns. ...

Alpine.js feels safe because it stays close to plain HTML. That’s part of why people trust it too much. I’ve seen teams assume “small framework” means “small attack surface.” Not true. Alpine gives you powerful ways to bind data into the DOM, evaluate expressions, and react to user input. Those same features can become XSS sinks if you feed them untrusted data. If you build with Alpine, the good news is simple: most XSS issues come from a handful of dangerous patterns. Avoid those, and Alpine is pretty manageable. ...

If you embed a chat widget, you’re adding a third-party UI surface that touches user-controlled data: names, emails, pre-chat forms, custom variables, URLs, campaign tags, support messages, and sometimes your own CRM content. That makes LiveChat-style widgets a classic XSS boundary. The main rule is simple: treat everything that enters or leaves the widget as untrusted. This guide focuses on the places developers usually get burned when integrating a LiveChat widget and shows safer patterns you can paste into real code. ...

WeChat mini-programs look like web apps, smell like web apps, and absolutely still give teams a false sense of security around XSS. I’ve seen this mistake a lot: a team assumes “it’s not running in a normal browser, so classic XSS doesn’t really apply.” That’s the wrong mental model. The attack surface is different, the rendering model is more constrained, and some browser features are missing, but untrusted data is still untrusted data. If your mini-program renders attacker-controlled content, builds templates carelessly, or bridges unsafe data into native-like APIs, you can still end up with script injection, UI redress issues, data theft, or malicious action execution. ...

Browser extensions are one of the weirdest XSS threat sources because the vulnerable code often isn’t yours. Your app can have solid output encoding, a decent CSP, and disciplined frontend code, then a user installs an extension that injects scripts, mutates the DOM, rewrites requests, or shoves untrusted HTML into your page. Suddenly your clean security model gets dragged into someone else’s mess. For developers, the hard part is that extension-driven XSS sits in an uncomfortable middle ground: ...