[Security Concepts] Which two preventive measures are used to control cross-site scripting? (Choose two)

Cross-Site Scripting (XSS) attacks are prevented by treating all user-provided data as untrusted. The two primary, complementary strategies are input sanitization and output encoding.

1. HTML Sanitization (D): When an application must accept and display rich content (HTML) from users, the input must be processed by a sanitization engine. This engine parses the HTML and removes potentially malicious elements and attributes (e.g., <script>, onerror) while permitting a whitelist of safe tags.

2. Contextual Output Encoding (B): This is the most critical defense. Before rendering any user-supplied data into the HTML output, it must be encoded or "escaped." This process converts special characters (like , ', ") into their HTML entity equivalents (e.g., <, >). This ensures the browser interprets the data as plain text to be displayed, not as executable code.

A. Enabling scripts on a per-domain basis describes a browser-level control (like Content Security Policy), which is a valuable defense-in-depth layer but not as fundamental as encoding or sanitization.

C. Disabling security inspections is counter-intuitive and not a recognized XSS prevention technique. Secure cookie attributes like HttpOnly are used to mitigate XSS impact, not prevent it.

E. The SameSite cookie attribute is a crucial security feature for preventing Cross-Site Request Forgery (CSRF), not XSS. Disabling it would weaken security.

1. MIT OpenCourseWare. (2014). Lecture 10: Web Security

6.858 Computer Systems Security. Massachusetts Institute of Technology. Slides 32-33. The lecture notes explicitly state the two main defenses against XSS are to "Filter/sanitize untrusted data on input" and "Escape untrusted data on output." This directly supports options D and B.

2. Cisco. (2016). Cisco SAFE Reference Guide. Document ID: 118323. In the "Application Security" section

when discussing XSS

the guide states

"The best way to protect against XSS is by contextually encoding all output that can contain untrusted data." This directly supports option B. The guide also emphasizes validating all input

which is the principle behind sanitization (Option D).

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education. Chapter 9

"Web Security

" section 9.3

"Attacks on Web Servers and Web Applications

" details Cross-Site Scripting. It identifies filtering user input (sanitization) and escaping output characters (encoding) as the primary countermeasures.