Implement Robust XSS Prevention Filters

This skill prevents Cross-Site Scripting through defense-in-depth: allowlist-based input validation, context-aware output encoding, and layered defenses (input filtering, output encoding, Content Security Policy, security headers). It implements a JavaScript HTML sanitizer using DOMPurify with an explicit allowed-tags/attributes list plus a regex-based event-handler/javascript-URI stripper, a Python XSSFilter class with distinct encoders per context (HTML via html.escape, JavaScript via json.dumps, URL via urllib.parse.quote, CSS via dangerous-character escaping), a PHP XSSProtection class removing control characters and dangerous patterns (script/iframe tags, javascript:/vbscript: URIs, event handlers) before HTML-encoding, an Express.js middleware setting a comprehensive CSP header plus X-Content-Type-Options/X-Frame-Options/Referrer-Policy, Jinja2 auto-escaping with a custom strict-escape filter adding extra encoding for parentheses/braces, a client-side XSSValidator flagging suspicious patterns in real time and a safe preview-sanitization function, and an implementation checklist plus common-mistakes list (blocklists instead of allowlists, single-pass filtering, inconsistent encoding across layers).

Use this skill when hardening an application against XSS - sanitizing HTML content with DOMPurify and an allowlist, applying context-specific encoding (HTML/JS/URL/CSS) before output, filtering dangerous patterns server-side in PHP, setting a comprehensive CSP and security headers, enabling auto-escaping in Jinja2 with an extra-strict custom filter, or adding real-time client-side input validation with a safe preview.

It does not cover other injection classes (SQL injection is a separate concern) - it is focused specifically on Cross-Site Scripting prevention across input filtering, output encoding, and browser-level CSP protection.

Inputs are typically user-supplied content that will be rendered in HTML, JS, URL, or CSS contexts. Outputs include sanitization/encoding functions, for example the Python context-aware encoder:

class XSSFilter:
    @staticmethod
    def html_encode(data):
        """Encode for HTML context"""
        if not isinstance(data, str):
            data = str(data)
        return html.escape(data, quote=True)
    
    @staticmethod
    def js_encode(data):
        """Encode for JavaScript context"""
        if not isinstance(data, str):
            data = str(data)
        return json.dumps(data)[1:-1]  # Remove surrounding quotes
    
    @staticmethod
    def url_encode(data):
        """Encode for URL context"""
        if not isinstance(data, str):
            data = str(data)
        return urllib.parse.quote(data, safe='')

Other outputs include a DOMPurify-based HTML sanitizer with an allowlist, a PHP multi-pattern XSS protection class, an Express CSP middleware, a Jinja2 auto-escaping setup with a strict-escape filter, a client-side real-time input validator, and an implementation checklist covering common mistakes to avoid.

The implementation checklist covers: never trust user input (always validate and sanitize), use established libraries like DOMPurify or the OWASP Java HTML Sanitizer rather than rolling your own, apply context-aware encoding since different output contexts need different approaches, run regular security audits against new attack vectors, keep libraries updated for security patches, implement CSP as additional browser-level protection, and log security events to monitor for attack attempts. For testing, it recommends regularly testing filters against payloads from the OWASP XSS Filter Evasion Cheat Sheet and maintaining updated test suites that include new attack vectors as they emerge, along with edge cases and Unicode variants that single-pass or blocklist-based filters commonly miss.

Web developers and security engineers hardening an application against XSS who need context-aware encoding and layered defenses across multiple languages rather than a single blocklist filter.