Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
| Property | |
|---|---|
| Language | regex |
| Severity |  |
| CWE | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
| OWASP | A07:2017 - Cross-Site Scripting (XSS) |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
Using unsanitized template variables directly in the ‘href’ attribute of anchor tags can let attackers inject malicious links, such as those starting with ‘javascript:’. This exposes your application to cross-site scripting (XSS) attacks.
Impact#
If exploited, an attacker could execute arbitrary JavaScript in the user’s browser, potentially stealing session cookies, user data, or performing actions on behalf of the user. This can lead to account compromise, data leaks, or unauthorized actions within your application.