ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During security testing of a new customer support portal, the team confirms that every form field is validated against a strict allow-list for length and allowed characters. Despite this, stored cross-site scripting is still possible because attackers embed HTML in comment text that is later rendered to other users. Which additional secure coding measure most directly eliminates this vulnerability?
Enforce HTTPS with HSTS headers to ensure all client connections use TLS.
Move the existing allow-list validation logic to client-side JavaScript to block malicious input earlier.
Replace the allow-list with a deny-list that strips known dangerous tags such as
Answer Description
Allow-list input validation helps reduce unexpected data, but it does not neutralize markup that is still permitted by the rules. When untrusted content is later inserted into an HTML page, the browser interprets any remaining tags or script. Context-aware output encoding (for example, HTML entity encoding or JavaScript string encoding) converts the characters that have special meaning in the target context into harmless representations before the data is delivered to the client. This prevents the browser from executing the attacker's scripts. Enforcing HTTPS or HSTS protects data in transit but does not stop XSS. Relocating validation to the client merely duplicates checks an attacker can bypass. Switching to a deny-list that strips known dangerous tags is brittle and frequently bypassed; modern guidance favors allow-list validation plus proper output encoding.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.