OWASP A05: Injection (2) — XSS, Razor Encoding, innerHTML, CSP and Trusted Types
We examine reflected, stored and DOM-based XSS in the Bookstore lab: HtmlEncoder and Razor's automatic encoding, the trap of writing a value from a JSON API with innerHTML and the textContent fix, Angular's sanitization and the bypassSecurityTrust* risk, then how CSP and Trusted Types stop unsafe code in headless Chrome as a second line of defense.
6 Nov 2026
·
8 min
·
5
