Unverified50% confidenceFactExact time
XSS (Cross-Site Scripting) is when a page renders user input directly as HTML, causing malicious scripts to execute in other people's browsers; it is divided into reflected, stored, and DOM types.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAllowing users to submit rich text content containing HTML markup can lead to XSS (Cross-Site Scripting) attacks, where malicious users can inject script tags to execute arbitrary JavaScript code.76% similarUnverified无JS页面天然规避了跨站脚本（XSS）攻击面，在安全敏感的内容展示场景下是有意义的架构选择71% similarUnverifiedMarkdown 解析器渲染 HTML 时的主要安全威胁是跨站脚本攻击（XSS），因标准 Markdown 允许内嵌原生 HTML69% similarUnverifiedXSS 防护主流方案包括输出净化（DOMPurify、sanitize-html）、沙箱隔离（iframe sandbox、Web Workers）和从源头禁用原始 HTML 内嵌69% similarUnverifiedUsing dangerouslySetInnerHTML in React bypasses the automatic escaping mechanism, leaving the developer fully responsible for content sanitization, and it is a common entry point for XSS.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1019670API
curl https://kongchang.com/api/v1/knowledge/claims/1019670MCP
get_claim(id=1019670)