Search Results

Follow the steps below to remediate this finding on Drupal. Audit libraries defined in *.libraries.yml files for external URLs.Replace CDN sources with local files where possible:my_library:js:/libraries/mylib/lib.min.js: {}For external sources that must remai...

Follow the steps below to remediate this finding on Generic / Developer guidance. DOM-based XSS occurs when JavaScript reads untrusted data (URL fragments, query strings, localStorage) and writes it to the DOM without sanitisation.Remediation steps:Never pass ...

Follow the steps below to remediate this finding on WordPress. Audit custom JavaScript files in your theme and plugins for unsafe DOM writes.Use wp_localize_script() to safely pass server-side data to scripts instead of embedding raw data in HTML.Escape values...

Follow the steps below to remediate this finding on Joomla. Review template JavaScript files and Joomla component JS for unsafe DOM manipulation.Use JUri to construct URLs safely server-side rather than building them from raw user input in JavaScript.Sanitise ...

Follow the steps below to remediate this finding on Drupal. Audit custom module JavaScript files for unsafe DOM writes.Use Drupal.behaviors to attach JS safely.Pass server-side data to JavaScript via drupalSettings (set in PHP with #attached['drupalSettings'])...

Follow the steps below to remediate this finding on Generic / Developer guidance. Reflected XSS occurs when user-supplied input is echoed back in the HTTP response without proper encoding.Remediation steps:Validate all input against an allowlist of expected ch...

Follow the steps below to remediate this finding on WordPress. Use WordPress escaping functions before outputting any dynamic data:esc_html() — for HTML contentesc_attr() — for HTML attributesesc_url() — for URLsesc_js() — for inline JavaScriptwp_kses() / wp_k...

Follow the steps below to remediate this finding on Joomla. Use Joomla's JFilterInput or InputFilter to sanitise input:$input = JFactory::getApplication()->input; $value = $input->get('param', '', 'STRING');For output, use JText::_() for translated strings and...

Follow the steps below to remediate this finding on Drupal. Use Drupal's input sanitisation and output escaping functions:\Drupal\Component\Utility\Html::escape($string) — HTML context\Drupal\Component\Utility\UrlHelper::filterQueryParameters() — URL contextUs...