This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /** | |
| * index.js | |
| * | |
| * Minimal Express app demonstrating a classic reflected XSS | |
| * vulnerability, for use as an article example. | |
| * | |
| * The app accepts a "message" via a form (or a "q" query param | |
| * on GET) and displays it back to the user by concatenating it | |
| * directly into an HTML string. Because the value is never | |
| * encoded, any HTML/JS an author types into the field is parsed |