This relies on two different XSS bugs where the page displays messages by just jamming them straight into the HTML output rather than properly encoding text to

This relies on two different XSS bugs where the page displays messages by just jamming them straight into the HTML output rather than properly encoding text to HTML. This technique – reusing the unprocessed input straight up as the output – doesn't seem like the first tool people ought to reach for just to display a simple string, so maybe the frameworks and templating libraries used make it far too easy to do the wrong thing? In Mithril, for example, injecting raw HTML requires you to explicitly call the trust method[1], so doing it wrong is more work than doing it right, and the documentation is very clear about the risks of trusting data. In Thymeleaf, displaying text uses th-text, injecting raw HTML uses th-utext and the documentation[2] in clear on the difference, but this seems a bit more subtle and easy to miss for those who aren't familiar with the consequences. Microsoft's ASP.NET, from what I can tell, used to[3] do it the PHP-style wrong-by-default way, relying on developers' unfailing vigilance in remembering to call Html.Encode every single time they display a value if they wanted to avoid XSS, but in version 4 syntax was added for displaying values as text by default. Their newer Razor templating library apparently[4] also does the right thing. So... maybe these pages were created in old-style ASP.NET? Or have newer libraries recreated the mistakes of the past? [1] https://mithril.js.org/trust.html https://mithril.js.org/trust.html [2] https://www.thymeleaf.org/doc/tutorials/3.0/usingthymeleaf.html#unescaped-text https://www.thymeleaf.org/doc/tutorials/3.0/usingthymeleaf.h... [3] https://weblogs.asp.net/scottgu/new-lt-gt-syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2 https://weblogs.asp.net/scottgu/new-lt-gt-syntax-for-html-en... [4] https://blog.slaks.net/2011/01/dont-call-htmlencode-in-razor.html https://blog.slaks.net/2011/01/dont-call-htmlencode-in-razor...