[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-572801-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-572801-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","detecting-cross-site-scripting-vulnerabilities-through-automated-unit-testing-abstract","Detecting Cross-Site Scripting Vulnerabilities through Automated Unit Testing - Abstract","","Security research on preventing Cross-Site Scripting (XSS) by using the correct context-aware encoders to sanitize untrusted data. Highlights a key failure mode: applying the wrong encoder leaves the application vulnerable. Proposes an automated unit-testing method that constructs XSS-focused tests from web pages and uses a grammar-based attack generator to create inputs. Evaluation on an open-source medical records system shows detection of many 0-day XSS issues with low false positives and improved test coverage versus best practices.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/general/","General",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/detecting-cross-site-scripting-vulnerabilities-through-automated-unit-testing-abstract/572801/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/detecting-cross-site-scripting-vulnerabilities-through-automated-unit-testing-abstract/572801.png","ImageObject",442,249,{"name":42,"@type":43},"lilac","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",7,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Why is using the correct encoder important for XSS prevention?","Question",{"text":63,"@type":64},"Encoding must match the web page context (e.g., HTML body, JavaScript). Using an incorrect encoder can leave injection payloads executable in the browser.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does the proposed approach automatically detect XSS vulnerabilities?",{"text":68,"@type":64},"It automatically constructs unit tests for XSS vulnerabilities from each web page, then executes them using a unit test framework with a grammar-based attack generator.",{"name":70,"@type":61,"acceptedAnswer":71},"What does the evaluation on a medical records application demonstrate?",{"text":72,"@type":64},"The approach detects many 0-day XSS vulnerabilities with very low false positives, and the grammar-based generator provides better test coverage than industry best practices.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},572801,1792086194,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,119,124],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},18,"Letters",30,"letters",{"id":120,"doc_module":22,"doc_module_name":25,"category_name":121,"show_sort_weight":122,"slug":123},21,"Paper Templates",5,"papers-templates",{"id":125,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":4,"slug":126},158,"general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":125,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":136,"language":137,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":12,"update_tm":141,"read_time":33},3985747861865,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Detecting Cross-Site Scripting Vulnerabilities through  \nAutomated Unit Testing  \nMahmoud Mohammadi, Bill Chu, Heather Richter Lipford  \nUNC Charlotte, Charlotte, NC , USA  \n(mmoham12, billchu, heather.lipford)@[uncc.edu](uncc.edu)  \nAbstract— The best practice to prevent Cross Site Scripting (XSS) attacks is to apply encoders to sanitize untrusted data. To balance security and functionality, encoders should be applied to match the web page context, such as HTML body, JavaScript, and style sheets. A common programming error is the use of a wrong encoder to sanitize untrusted data, leaving the application vulnerable. We present a security unit testing approach to detect XSS vulnerabilities caused by improper encoding of untrusted data. Unit tests for the XSS vulnerability are automatically constructed out of each web page and then evaluated by a unit test execution framework. A grammar-based attack generator is used to automatically generate test inputs. We evaluate our approach on a large open source medical records application, demonstrating that we can detect many 0-day XSS vulnerabilities with very low false positives, and that the grammar-based attack generator has better test coverage than industry best practices.  \nKeywords—security; unit testing; injection attacks; program analysis; attack generation  \nI. INTRODUCTION  \nCross Site Scripting (XSS) is one of the most common security vulnerabilities in web applications. Cross Site Scripting attacks occur when an attacker successfully injects a malicious JavaScript payload into a web page to be executed by users requesting such a web page. Advised best practice to prevent XSS attacks is to encode untrusted program variables with dynamic content before their values are sent to the browser. While one can prevent all XSS attacks by using the most strict encoder, it also takes away many useful web site functions. To balance security and functionality, developers must therefore choose the appropriate encoder depending on the context of the content, such as HTML or JavaScript. Static analysis [15] techniques are widely used to ensure a web application uses encoding functions to sanitize untrusted data. However, static analysis cannot verify whether the correct encoding function is used. Acunetix Web Application Vulnerability Report [1] shows that nearly 38% and 33% of web sites were vulnerable to XSS attacks in 2015 and 2016 respectively.  \nIn this paper we present a unit-testing based approach to automatically detect XSS vulnerabilities due to incorrect encoding function usage. We have built a proof-of-concept implementation for web applications written in Java and JSP. This approach can be extended to other server-side web programming languages as well (e.g. PHP and ASP) . For therest of this section, we provide a brief background on encoding and our approach.  \nWell tested encoding functions have been written for content placed in the following contexts: HTML body, HTML attribute, CSS, URL, and JavaScript. Consider the fragment of a JSP program shown in Fig 1. Native Java code is enclosed in \u003C%%> .  \n1. \u003C% String pid = (String)request.getParameter(\"pid\"); %>  \n2. \u003C% String addr = (String) request.getParameter(“addr”);%>  \n3. \u003Ca href= \"javascript:void(0)\" onclick=\"action(‘\u003C%=escapeHtml(pid) %>’)\"> mylink \u003C/a>  \n4. \u003Cp> \u003C%=escapeHtml(addr) %>  \nFig. 1. Motivating Example  \nThis example has two user provided inputs: pid and addr. Variable pid is used as part of rendering an HTML anchor element on line 3, and addr is displayed in the HTML body online 4. A maliciously supplied input for addr might be  \n\u003Cscript> atk(); \u003C/script> .  \nIf the encoding function, escapeHtml(), were not applied, this would cause the execution of the JavaScript function atk() on line 4. Encoding function escapeHtml() replaces \u003C and > characters with < and > respectively and transforms the malicious input into the following string, preventing atk(); from being interpreted as a JavaScript program by the","cbCaitEno3zxXTl3","https://ap.wps.com/l/cbCaitEno3zxXTl3","pdf",306782,10,"English","# Introduction\n## Context-aware encoding and XSS background\n## Proposed unit-testing approach\n## Motivating example (JSP encoding)","[{\"question\":\"Why is using the correct encoder important for XSS prevention?\",\"answer\":\"Encoding must match the web page context (e.g., HTML body, JavaScript). Using an incorrect encoder can leave injection payloads executable in the browser.\"},{\"question\":\"How does the proposed approach automatically detect XSS vulnerabilities?\",\"answer\":\"It automatically constructs unit tests for XSS vulnerabilities from each web page, then executes them using a unit test framework with a grammar-based attack generator.\"},{\"question\":\"What does the evaluation on a medical records application demonstrate?\",\"answer\":\"The approach detects many 0-day XSS vulnerabilities with very low false positives, and the grammar-based generator provides better test coverage than industry best practices.\"}]","Detecting Cross-Site Scripting Vulnerabilities through Automated Unit Testing - Abstract | PDF",1791929315]