<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>

<overview>
	<p>

		Directly using uncontrolled stored value (for example, file names) to
		create HTML content without properly sanitizing the input first,
		allows for a cross-site scripting vulnerability.

	</p>
	<p>

		This kind of vulnerability is also called <i>stored</i> cross-site
		scripting, to distinguish it from other types of cross-site scripting.

	</p>
</overview>

<recommendation>
	<p>

		To guard against cross-site scripting, consider using contextual
		output encoding/escaping before using uncontrolled stored values to
		create HTML content, or one of the other solutions that are mentioned
		in the references.

	</p>
</recommendation>

<example>
	<p>

		The following example code writes file names directly to a HTTP
		response. This leaves the website vulnerable to cross-site scripting,
		if an attacker can choose the file names on the disk.

	</p>
	<sample src="examples/StoredXss.js" />
	<p>
		Sanitizing the file names prevents the vulnerability:
	</p>
	<sample src="examples/StoredXssGood.js" />
</example>

<references>
	<li>
		OWASP:
		<a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet">XSS
		(Cross Site Scripting) Prevention Cheat Sheet</a>.
	</li>
	<li>
		OWASP
		<a href="https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting">Types of Cross-Site
		Scripting</a>.
	</li>
	<li>
		Wikipedia: <a href="http://en.wikipedia.org/wiki/Cross-site_scripting">Cross-site scripting</a>.
	</li>
</references>
</qhelp>
