CWE-87 (替代XSS语法转义处理不恰当) — Vulnerability Class 34

CWE-87 represents an input validation weakness where software fails to properly sanitize user-controlled data against alternative script syntaxes, such as HTML entities, Unicode escapes, or embedded scripts within attributes. Attackers typically exploit this flaw by injecting malicious payloads that bypass standard filtering mechanisms, allowing them to execute arbitrary JavaScript in the victim’s browser context. This can lead to severe consequences, including session hijacking, credential theft, or defacement of the web application. To mitigate this risk, developers must implement robust output encoding strategies tailored to the specific context of the data insertion, such as HTML entity encoding for body content or attribute encoding for HTML attributes. Additionally, utilizing comprehensive, well-maintained security libraries and adhering to strict Content Security Policy headers can significantly reduce the attack surface, ensuring that alternate syntax variations are correctly neutralized before rendering.