Tag
output-encoding
- Jan 28, 2026 DOM XSS: Sources, Sinks, and Why the Server Never Sees the Payload How client-side flow from attacker-controlled input to an executing sink bypasses server-side encoding, and which of the flow-tracking approaches can follow the value. security
- Mar 27, 2022 HTML Parsing Contexts and Why One Escape Function Is Never Enough How the HTML tokenizer switches states by context, what each state treats as dangerous, and why encoding rules must be chosen per insertion point rather than per application. security