new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

output encoding

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Encode data before use in output contexts

When using data to build HTML, script, CSS, XML, JSON, or other markup, data must be properly encoded before being used to prevent injection style issues and preserve logical meaning. Use encoding libraries such as the OWASP Java Encoder Project.

XSS in extensions - sanitize user input with DOMPurify

To prevent cross-site scripting (XSS) in browser extensions: implement Content Security Policy (CSP) to block inline scripts, use libraries like DOMPurify to sanitize user input before displaying it, and avoid using innerHTML and instead use textContent to prevent execution of injected scripts.

Content Security Policy in manifest.json example

Define a strict CSP in the extension's manifest.json file. Use nonce-based or hash-based policies to allow only trusted scripts. Block execution of inline scripts and restrict third-party content sources. Example: "content_security_policy": "default-src 'self'"

Give your agent this brain