#xss 5 articles

• A formatter that returns its raw input is a hole in your escapinggotchas / securityThe unhappy branch returns the value verbatim; about:blank inherits your origin
• An allowlist sanitizer that keeps the text of disallowed tags dumps CSS and JavaScript source into your contentgotchas / securityAn allowlist needs two sets: tags to keep, and tags to drop WITH their subtree; otherwise a pasted web page dumps its stylesheet into the article as visible text
• Previewing library files in your own app: every format behaves differentlygotchas / spfxPDF embeds directly, Office needs WOPI by {UniqueId}, HTML is served as an attachment and never renders from src; SVG and HTML must never be framed from your own origin (uploader script runs in the viewer session) and…
• Stored XSS via SharePoint list content — React won't save yougotchas / securityReact doesn't block javascript: hrefs; allowlist safeHref with C0-strip at every sink
• Your URL sanitiser strips spaces — and every SharePoint file link 404sgotchas / securityThe C0 strip that blocks javascript: also eats the plain space, so every link to /Shared Documents/… 404s; strip to decide, return with %20