Prevent XSS with Context-Aware Output Encoding

Encode dynamic output for the correct context so a value in an HTML attribute is escaped differently than one in a script block.

~20 minsecurityxssencoding

Task

Implement const safe = htmlEncode(userInput); // context: HTML text node to close a known attack surface before the next security review finds it.

When to use this

A penetration test report flags the missing const safe = htmlEncode(userInput); // context: HTML text node as a medium-severity finding on a public endpoint.

Prerequisites

A running application with the vulnerable endpoint
Access to security headers or middleware config

Steps

1. Configure const safe = htmlEncode(userInput); // context: HTML text node in the project configuration file with the recommended defaults.

const safe = htmlEncode(userInput); // context: HTML text node

Expected output: The configuration is accepted and const safe = htmlEncode(userInput); // context: HTML text node runs without errors on the first invocation.

2. Run the check locally to verify const safe = htmlEncode(userInput); // context: HTML text node produces the expected result before pushing.

pnpm test

Expected output: Local run matches CI behavior; no surprises after push.

3. Add the gate to the CI pipeline so const safe = htmlEncode(userInput); // context: HTML text node blocks merge on failure.

- name: Run add xss output encoding
  run: pnpm test

Expected output: Pull requests with failing const safe = htmlEncode(userInput); // context: HTML text node are blocked from merging.

Troubleshooting

Problem

The check passes locally but fails in CI

Solution

Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.

Problem

Configuration is rejected with a schema error

Solution

Check the tool version matches the config schema; older versions may not support newer fields.

Limitations

The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
Configuration drift is possible if someone edits settings outside version control.

Close the attack surface

Start by measuring the problem. Encode dynamic output for the correct context so a value in an HTML attribute is escaped differently than one in a script block. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run const safe = htmlEncode(userInput); // context: HTML text node against the current codebase and inspect the output before wiring it into CI.

const safe = htmlEncode(userInput); // context: HTML text node

Verify and monitor

Once the gate is in place, make failures actionable. A failing const safe = htmlEncode(userInput); // context: HTML text node should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.