Software Engineering › Key terms › Code patterns › XSS JavaScript fragment reading
XSS JavaScript fragment reading
Code pattern Code patterns
Definition
Be able to read a short JavaScript fragment and spot where untrusted input is inserted into a page without sanitising.
Example
element.innerHTML = userInput is unsafe.Found in: syllabus, course specifications, sample exam and familiarisation guidelines, school notes.
Where it is used in the test
Syllabus area: Code patterns.
Question types it can appear in
- Code reading: Code or algorithm reading: interpret a fragment and state its output or purpose.
- Short answer: Define, outline or explain it and tie it to the scenario.
Where it has appeared in the paper
Secure Software Architecture (Part C). Part letters follow each paper’s own layout.
Related past questions
- Familiarisation Q11a (1 mark): Cross-site scripting Secure Software Architecture (Part C) · 1 mark
- Familiarisation Q11b (2 marks): Cross-site scripting Secure Software Architecture (Part C) · 2 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: XSS JavaScript fragment reading in Code Patterns: Pseudocode, Python, SQL, CSS (Years 11 and 12) · study that set
- Memorise: SQL: HSC syntax and must-know queries
How to use it in an answer
A model sentence
Code pattern: “Be able to read a short JavaScript fragment and spot where untrusted input is inserted into a page without sanitising.” Then apply it: element.innerHTML = userInput is unsafe.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
Technique for the question types
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
What the marking guidelines and feedback say
Note (MG): special characters such as < > and ( ) would be encoded to their HTML equivalent (%3C %3E and %28 %29).
Worked answers from the marking guidelines
Familiarisation Q11a (1 mark): Cross-site scripting (1 mark): criteria and sample answer
Criteria
1: Identifies the correct answer.
Sample answer
Cross site scripting
Familiarisation Q11b (2 marks): Cross-site scripting (2 marks): criteria and sample answer
Criteria
2: Explains ONE way to minimise the vulnerability. 1: Some relevant information.
Sample answer
The website could check and change user input so that markup and script become plain text. This will still allow the page to display the information but will prevent it from executing script code.
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: SQL statement structure · SQL relational and logical operators · SQL calculated aggregate with GROUP BY · CSS rule syntax · Shell script pattern