XSS JavaScript fragment reading

Code pattern

Jump to a topic

See every item in the sequence

Definition

Be able to read a short JavaScript fragment and spot where untrusted input is inserted into a page without sanitising.

Example

element.innerHTML = userInput is unsafe.

Found in: syllabus, course specifications, sample exam and familiarisation guidelines, school notes.

Where you'll use it in the test

Syllabus area: Code patterns.

Question types it can appear in

Code reading: Code or algorithm reading: interpret a fragment and state its output or purpose.
Short answer: Define, outline or explain it and tie it to the scenario.

Where it has appeared in the paper

Secure Software Architecture (Part C). Part letters follow each paper’s own layout.

How to use it

A model sentence

General advice, built from the definition and example above

Code pattern: “Be able to read a short JavaScript fragment and spot where untrusted input is inserted into a page without sanitising.” Then apply it: element.innerHTML = userInput is unsafe.

In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.

Command words used with it

From the linked past questions

Identify: Recognise and name. (Familiarisation Q11a (1 mark): Cross-site scripting)
Explain: Relate cause and effect; make the relationship between things evident; provide why and/or how. (Familiarisation Q11b (2 marks): Cross-site scripting)

Official worked answer

Familiarisation Q11a (1 mark): Cross-site scripting (1 mark): official criteria and sample answer

Criteria

1: Identifies the correct answer.

Sample answer

Cross site scripting

Open the question page

Go deeper

Flashcard: XSS JavaScript fragment reading in Code Patterns: Pseudocode, Python, SQL, CSS (Years 11 and 12) · study that set
Memorise: SQL: HSC syntax and must-know queries
Full term page: every question, note and marking comment for XSS JavaScript fragment reading

Check yourself

Write or say the “XSS JavaScript fragment reading” pattern from memory: the syntax and what it does.

Reveal the answer