CheatSheetSeries | The OWASP Cheat Sheet Series was created to provide a concise collection of high value information o | Cybersecurity library

I eventually figured it out after hours of trial and error. The idea is to close the dangling tag with a separate tag:

So the previous payload was:

"Contexts" here refers to basically places where text can go in an HTML document. The OWASP XSS Prevention guide you're referencing aims to educate developers on how to safely place untrusted data in HTML.

Because HTML can do a lot of different stuff, it's important to understand exactly where your untrusted data is going so you can understand the risks and specific mitigation strategies.

The link you provided identifies several contexts:

It's just an attribute on the element. It doesn't have any meaning by itself, so it may be present simply as a red herring.

Prettified, the code is:

This is still something that’s not formally specified and there ai still some debate on this: https://github.com/w3c/webappsec/issues/520

In general there’s two arguments here:

On the one hand some other file types (XML, PDF, perhaps even SVGs) could benefit from CSP and any resource could become the page by right clicking and opening in a separate tab.

On the other hand CSPs can get quite big and are usually written for HTML pages. So a bit wasteful to send on other resources and most of it won’t be relevant.

The right answer (as suggested by above) is probably to have a reduced, and very strict, CSP for all non-HTML responses.

But I think for most people having it on the HTML only will be good enough and bring most of the benefits of CSP. Then again CSP is an advanced technique so if going as far as that, then why not do it properly?

The xsl:value-of instruction does exactly what you are describing: it extracts the string value of an element, dropping all internal markup.

To retain the existing markup unchanged, use the xsl:copy-of instruction.

To process the internal markup, turning it into something else, use the xsl:apply-templates instruction, with appropriate template rules to handle the descendant elements encountered.

Finally, please don't use w3schools as your primary learning resource. It's handy as a quick reference when you understand the concepts of the language and need a reminder of the details. It's not a good way of learning the concepts initially. It's also not a good place to go once you're beyond the basics and need a detailed explanation of edge cases (it tends to simplify).

Note: you say "I can't find anything that explicitly says that xsl:value-of invalidates anchor tags inside of the string it returns". w3schools says "The xsl:value-of element extracts the value of a selected node." But (typically) it doesn't say what it means to "extract the value". If you go to the XSLT 1.0 specification, however (https://www.w3.org/TR/xslt-10/#value-of) it's very clear: "The xsl:value-of element is instantiated to create a text node in the result tree. The required select attribute is an expression; this expression is evaluated and the resulting object is converted to a string as if by a call to the string function. The string specifies the string-value of the created text node." The fact that xsl:value-of creates a text node means (if you've understood the concept of the tree model) that it can't possibly retain any descendant node structure.

The frame-ancestors 'none' directive will indicate to the browser on page load that it should not be rendered in a frame (including frame, iframe, embed, object, and applet tags). In other words the policy does not allow it to be framed by any other pages.

The CSP header for the API or page is read at load. It is not something that happens after the fact. The "main" CSP isn't pertinent because it's the URI in the frame that's sending the CSP for itself over. The browser simply honors the frame-ancestor 'none' request by that URI

The frame-ancestors directive restricts the URLs which can embed the resource using frame, iframe, object, or embed. Resources can use this directive to avoid many UI Redressing [UISECURITY] attacks, by avoiding the risk of being embedded into potentially hostile contexts.

References
CSP frame-ancestors
Clickjacking Defense Cheat Sheet
Content Security Policy
Web Sec Directive Frame Ancestors

The Same Origin Policy prevents this.

You'll need to find a different approach.

the flag sign_in_after_reset_password does not relate to logout user at all, sign_in_after_reset_password = false imply that in case a user update his account password by himself then do not automatically sign-in his account again, and that logic happen only on PasswordsController#update. So you as admin try to change password of another user in a custom controller, of course it's not logout user no matter the value of sign_in_after_reset_password is.

devise use gem warden to logout user (in other word: destroy user session) and warden base on request session not base on database, that mean there's no way an admin can get another user's session to reset, so you can not force logout another user by only devise, you need to handle this feature outside devise (such as add session to user table or a devise hook something like timeoutable)

reference: https://github.com/heartcombo/devise/issues/5262

When working with the DOM, there are no html encoding issues in any element properties. The characters <, >, &, ", and ' do not need escaping.

However, you still need to deal with the semantics of the respective attribute. While title is just a plain string that's not used for anything but displaying tooltips, others are not safe:

• on… event handlers contain javascript code. It's a bad practice to assign strings to them anyway, but if you do, interpolating values must follow javascript escaping rules.
  ⇨ Rule #3
• style properties contain CSS rules which need their own escaping.
  ⇨ Rule #4
• src or href attributes are urls that the browser will load at some point. Those definitely are sensitive, and when interpolating values into urls you need to follow URL encoding rules.
  ⇨ Rule #5
• … (not meant to be exhaustive)

In your particular case, if you fail to url-encode the untrustedStr2, the attacker may send arbitrary query parameters or fragments to example.com. This is not a security issue in itself if example.com isn't susceptible to reflected XSS (the attacker may send the same link to the user via other channels), but it is broken functionality (undesired behaviour), but still it's your page endorsing the linked content.

So if untrustedStr2 is meant as a value of the id URI query parameter, you should definitely use