Software Engineering › Learn step by step › Y12 Secure Software Architecture
Item 218 of 426 · Year 12: Secure Software Architecture, 41 of 57
Cross-site scripting (XSS)
Term Key terms bank
Jump to a topic
- Exam format, question types and command words (46)
- Year 11: Programming Fundamentals (69)
- Year 11: The Object-Oriented Paradigm (33)
- Year 11: Programming Mechatronics (29)
- Year 12: Secure Software Architecture (57)
- Year 12: Programming for the Web (59)
- Year 12: Software Automation (35)
- Year 12: The Software Engineering Project (47)
- Diagrams and modelling tools (18)
- Python, SQL, pseudocode and CSS patterns (33)
Definition
An attack that injects malicious script into a web page that other users then run in their browser. Prevent it by sanitising and escaping output.
Example: Escape user comments so scripts cannot run.
Found in: syllabus, course specifications, sample exam and familiarisation guidelines, school notes.
Cross-site scripting: malicious script injected into a page other users view.
Where you'll use it in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: Familiarisation Q11a
- Short answer: Explain how XSS works and how to prevent it (Q11b)
- Fill in the blanks: Choose this term to complete a statement or table.
Where it has appeared in the paper
Secure Software Architecture (Part C). Part letters follow each paper’s own layout.
Related past questions
- Familiarisation Q11a (1 mark): Cross-site scripting Secure Software Architecture (Part C) · 1 mark
- Familiarisation Q11b (2 marks): Cross-site scripting Secure Software Architecture (Part C) · 2 marks
How to use it
A model sentence
“An attack that injects malicious script into a web page that other users then run in their browser.” Then apply it: Escape user comments so scripts cannot run.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
Official worked answer
Familiarisation Q11a (1 mark): Cross-site scripting (1 mark): official criteria and sample answer
Criteria
1: Identifies the correct answer.
Sample answer
Cross site scripting
Go deeper
- Flashcard: Cross-site scripting (XSS) in Secure Software Architecture (Year 12) · study that set
- Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions
- Key terms bank entry: XSS
- Notes: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions (Secure Software Architecture (Year 12))
- Notes: Design, develop and implement secure code to minimise vulnerabilities in user action… (Secure Software Architecture (Year 12))
- Notes: Defensive data input handling: validation, sanitisation, error handling (Secure Software Architecture (Year 12))
- Full term page: every question, note and marking comment for Cross-site scripting (XSS)
Check yourself
Explain “Cross-site scripting (XSS)” in one sentence, give an example, and name a question type that could test it.
Reveal the answer
An attack that injects malicious script into a web page that other users then run in their browser. Prevent it by sanitising and escaping output.
Example: Escape user comments so scripts cannot run.
Could be tested as: Multiple choice, Short answer, Fill in the blanks.
Quick multiple choice
Which describes a cross-site scripting (XSS) attack?
- An attacker injects malicious script into a page that is then run in other users' browsers
- An attacker reads data by timing how long a CPU operation takes
- An attacker guesses passwords using a list of common words
- An attacker floods a server with requests
Show the answer
A
XSS = injected script executes in a victim's browser. Prevent it by sanitising or escaping user content before output.
Source: original (written for this study pack; not a NESA question). Open it in the multiple-choice bank.