## Cross-Site Scripting XSS (High)

### Trigger Signals

- User input directly concatenated into HTML response body (`innerHTML`, template literals concatenated into HTML)
- `document.write()`, `document.writeln()` receiving user input
- `eval()`, `Function()`, `setTimeout(string)`, `setInterval(string)` executing user input
- URL hash/query parameters directly inserted into DOM
- Framework `dangerouslySetInnerHTML`, `v-html`, `[innerHTML]` receiving user input

### Key Sinks

| XSS Type | Sink Functions/Patterns |
|---------|---------------|
| Reflected XSS | `res.send(user_input)`, `response.write(user_input)`, unescaped template engine output |
| Stored XSS | Stored then output without escaping (database store → read → render directly to HTML) |
| DOM-based XSS | `element.innerHTML = input`, `document.write(input)`, `$(element).html(input)` |
| JS Execution | `eval(input)`, `setTimeout(input)`, `new Function(input)` |

### Judgment Process

1. **Identify Sinks**: `Read` extracts HTML output and JS execution operations, marking Sink points
2. **Trace back to Source**: `find_references` traces backward from Sink parameters (up to 5 levels), determining whether data comes from user input
3. **Check context**: `Read` confirms the output context of the Sink:
   - HTML content (requires HTML entity escaping)
   - HTML attributes (requires attribute value escaping)
   - JavaScript code (requires JS escaping)
   - URLs (requires URL encoding)
   - CSS (requires CSS escaping)
4. **Check defense mechanisms**: `Read` confirms whether the following exist:
   - Framework auto-escaping (React JSX, Vue `{{ }}` default escaping)
   - Explicit escaping functions (`escapeHtml`, `DOMPurify.sanitize`)
   - Content-Security-Policy header (restricts script execution sources)
   - `HttpOnly` cookie flag (prevents cookie theft)

### Evidence Construction

After confirming a defect, the output must include:
- Source (user input origin, with file:line number)
- Sink (unescaped output/execution location, with file:line number)
- Output context (HTML content/attribute/JS/URL/CSS)
- Exploitation scenario (specific XSS payload example, e.g., `<script>alert(1)</script>`)

### Exclusions

- Framework default escaping protection (React JSX, Vue `{{ }}`, Angular interpolation)
- Already using `DOMPurify` or equivalent library for sanitization
- CSP header set without `unsafe-inline`/`unsafe-eval`
- Pure JSON API responses (Content-Type is application/json, not HTML)
