Niakanlahiji and Jafarian [129] proposed a different MTD technique. They
modify web applications by adding a new attribute named runtimeID to
suspicious tags with randomly generated hex value. The head of each page is
also modified to include a script that will be executed for every user
request. The role of that script is to generate a random hex identifier and
add it to each runtimeID attribute in the page. At the browser side, new added
elements without a runtimeID attribute or with different runtimeID value are
considered as malicious and are removed automatically. The solution produces
no false positives and has low average overhead (4ms). Unfortunately, it
requires manual interventions to add the runtimeID attribute to sensitive
elements.

####  7.3.3 Sandboxing/Isolation

Sandboxing is an isolation technique that enables the full control of running
applications and prevents suspicious actions to be propagated. Cao et al. [54]
proposed a refined sandboxing technique to prevent WXSS attacks. Rendered
pages are isolated at the client-side. Every web page is divided into
different and separate parts named views according to a specific strategy.
Each view has a list of predefined authorized actions. Therefore, views cannot
perform and request actions from other views without authorization. For
isolation, pseudo-domains are associated to views and each view has a list of
controlled capabilities. This way, every required connection from one view to
another is controlled by an authentication mechanism. For example, a request
to the server to modify a content-profile will be verified and blocked if it
is originated from an infected page (not authorized action). The request
emanating from a view that has no capability to send it, is blocked. This can
be implemented by techniques like per-url session tokens and referrer-based
view validation. The technique has a reasonable latency and memory overhead
(about 1% and 4% respectively) but involves modifications of web applications
to define views and their correspondent authorized actions.

####  7.3.4 XSS attack detection and defense techniques

Nine studies included in this review proposed a runtime detection with defense
techniques. Remarkably, runtime sanitizer instrumentation is the dominant
approach adopted as a defense technique. Table LABEL:tab:athybrid summarizes
those studies highlighting their targeted attacks and limitations.

Table 10: XSS attack detection and defense techniques study |  detection method |  defense method |  attacks |  limitations
---|---|---|---|---
Bisht and Venkatakrishnan [27] |  HTTP traffic monitoring and matching shadow and real generated pages. Shadow pages are obtained through transmitting HTTP requests with benign string inputs. |  Remove all scripts not present in intended pages. |  Unspecified |  • performance overheads ranged from 5% to 24%. • produces false positives when attacks use non-Firefox quirks.
Bates et al. [37] |  HTTP traffic monitoring and matching scripts from HTTP requests and responses after recursive decoding |  Refuse to deliver matched scripts to the JS engine. |  RXSS |  • limited to the detection of single injections omitting multiple injections. • requires modifications on the browser.
Pelizzi and Sekar [56] |  HTTP traffic monitoring and matching scripts from HTTP request and response parameters |  Refuse to deliver matched scripts to the JS engine. |  RXSS |  • requires the modification of the browser to check the execution permission of each script. • unable to detect scripts subjected to extensive string transformations by web applications.
Gupta and Gupta [82] |  HTTP traffic monitoring and matching scripts from HTTP requests and DOM trees generated for HTTP responses |  Runtime context-aware sanitizer instrumentation. |  WXSS |  • low detection rate (F1-score less than 95%).
Gupta and Gupta [94] |  HTTP traffic monitoring and matching scripts from HTTP requests and responses |  Runtime context-aware sanitizer instrumentation. |  RXSS, SXSS, DXSS |  • no performance overhead analysis is performed.
Gupta et al. [106] |  HTTP traffic monitoring and matching scripts stored and generated DOM trees |  Runtime context-aware sanitizer instrumentation. |  DXSS |  • quite large overhead due to runtime nested auto-context-sensitive sanitization.
Lalia and Sarah [112] |  HTTP traffic monitoring and matching script features extracted form generated HTTP responses with those stored after performing a static analysis. |  Runtime context-aware sanitizer instrumentation. |  RXSS, SXSS |  • not suitable for encoded scripts and CSS file scripts. • relies on the presence of clean pages at the server. • high false positive and negative rates due to the ignorance of dynamically generated scripts.
Gupta and Gupta [113] |  HTTP traffic monitoring and matching stored sanitized JS variables with unsantized ones generated from HTTP responses. Stored sanitized JS variables are collected through performing a dynamic analysis. |  Runtime context-aware sanitizer instrumentation. |  WXSS |  • low detection rate (less than 97%).
Chaudhary et al. [116] |  HTTP traffic monitoring through matching stored and generated scripts. |  Action authentication with Runtime context-aware sanitization. |  WXSS |  • lack of performance overhead analysis.

##  8 What type of evidences are used to validate solution proposals? (RQ5)

The diversity of solution proposals enabled the use of different validation
techniques and data sources. In this section, we describe the different
validation techniques used to check the effectiveness of proposed solutions as
well as sources used for experimentation. This allowed us to evaluate the
quality of studies included in this review and may help researchers to
replicate existing studies.

###  8.1 Validation techniques

The adopted data extraction process allows the identification of variant
validation techniques adopted by existing studies. Case study, quantitative
comparison with similar works and performance overhead analysis are the most
adopted techniques as showed in Figure 9.

Figure 9: Distribution of validation techniques

Figure 10 shows refined results where adopted validation techniques are
distributed per type of contribution to tackle the attack. Despite the
importance of overhead analysis in runtime detection of attacks, several
studies focused only on their detection performances omitting such important
factor. This prevents fair comparison of accurate validation of existing
proposals and checks their usefulness in practice.

Figure 10: Distribution of validation techniques per contribution to tackle
XSS attacks and vulnerabilities

###  8.2 Data sources used in validation

Different publicly available sources for XSS have been used. Those sources are
given in Table LABEL:tab:xssvect together with the list of studies using them.
Note that only active links are reported in the table, dead links are ignored.
It can be depicted that XSSeed, OWASP and HTML5 Security CheatSheet are the
most used sources for retrieving malicious XSS payloads. Alexa top sites are
the most experimented URLs and sources to extract benign scripts. Only four
complete datasets are made available in Github, Kaggle and figshare.

Table 11: XSS attack vectors data sources: M = Malicious, B = Benign, MB: Mixed source |  link | type |  studies
---|---|---|---
XSSed project |  http://www.xssed.com/ | M |  [33], [37], [39], [51], [56], [71], [86], [95], [104], [119], [127], [130], [140], [141], [147], [153], [158], [160], [162]
Open Bug Bounty |  https://www.openbugbounty.org/ | M |  [111], [140], [158]
DMoz Archive |  http://dmoztools.net/ | B |  [51], [71]
ClueWeb+ |  https://www.lemurproject.org/ | B |  [48], [51], [119]
Alexa |  https://www.alexa.com/topsites | B |  [52], [58], [66], [72], [77], [79], [97], [104], [108], [121], [147], [156], [157], [160]
Github |  https://github.com/duoergun0729/1book/tree/master/data | M |  [118], [153]
|  https://github.com/IramTariq/XSS-attack-detection | MB |  [153]
|  https://github.com/ajinabraham/OWASP-Xenotix-XSS-Exploit-Framework | M |  [117]
|  https://github.com/bsmali4/XSSfork | M |  [117]
|  https://github.com/fuzzdb-project/fuzzdb | M |  [75], [117]
|  https://codeload.github.com/foospidy/payloads/zip/master | M |  [117]
|  https://github.com/stivalet/PHP-Vulnerability-test-suite | MB |  [92]
|  https://github.com/payloadbox/xss-payload-list | M |  [149], [150], [161]
|  https://github.com/WhiteRabbitc/Wooyun-Email-XSS-Dataset/tree/master/malious-sample | M |  [139]
|  https://github.com/yahoo/webseclab | M |  [148]
|  https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/XSS/XSS-RSNAKE.txt | M |  [144], [146]
|  https://gist.github.com/kurobeats/9a613c9ab68914312cbb415134795b45 | M |  [144]
Kaggle |  https://www.kaggle.com/syedsaqlainhussain/cross-site-scripting-xss-dataset-for-deep-learning | MB |  [149], [161]
OWASP project |  http://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet | M |  [33], [42], [68], [74], [75], [76], [88], [91], [94], [102], [106], [109], [113], [122], [125], [135], [138], [144]
HTML5 Security Cheatsheet |  http://html5sec.org/ | M |  [74], [75], [76], [82], [94], [102], [106], [109], [113], [114], [135], [138], [143], [144], [146]
Vulnerability Lab |  https://www.vulnerability-lab.com/ | M |  [74], [82], [94], [102], [106], [109], [113], [114], [135]
Burp suite |  http://portswigger.net/burp | M |  [117], [146], [160]
CWE+ |  https://cwe.mitre.org/data/index.html | M |  [132]
figshare |  https://figshare.com/articles/dataset/XSS_dataset1_csv/13046138/4 | MB |  [133]
Impact Cyber Trust |  https://www.impactcybertrust.org/dataset_view?idDataset=940 | M |  [154]
PastBin |  https://pastebin.com/BdGXfm0D | M |  [74]
JS CheatSheet |  https://htmlcheatsheet.com/js/ | B |  [150]
Chef Secure |  https://chefsecure.com/blog/the-12-exploits-of-xss-mas-infographic | M |  [150]
Exploit database |  https://www.exploit-db.com/ | M |  [129], [159]
Information Technology Laboratory |  https://nvd.nist.gov/vuln | M |  [35]

##  9 Issues and open challenges

In this section, we discuss limitations, issues and open challenges preventing
the proper handling of XSS attacks. Those issues and challenges are derived
from the findings of the present review.

###  9.1 Lack of appropriate vulnerability repair mechanisms

Handling XSS vulnerabilities is a first step toward defending against XSS
attacks. But vulnerability repair has earned less attention compared with
detection and mitigation. Mitigation techniques are important but have several
unstudied flaws. Secure APIs require much time for their development,
feasibility check, standardization and adoption by different browsers. Secure
templating are framework dependent and they are still in their infancy stage.
Sanitization is an intuitive solution to eliminate XSS vulnerabilities but
more automatic tools and guidelines are need to be provided for their
appropriate and easy usage by inexperienced developers. Therefore, automatic
and easy to use tools for detection with repair capabilities of XSS
vulnerabilities are still an open research direction that has not yet been
sufficiently explored.

###  9.2 Limitations of vulnerability detection techniques

For the detection of XSS vulnerabilities, both static and dynamic analysis are
explored by existing studies. Those approaches have several known limitations.
Static analysis based approaches require the availability of the code of
tested web applications and suffers from reporting high false positive rates
[175]. Besides those general limitations, individual static based solutions
have other specific flaws. Model driven-based code auditing is unsuitable for
large web applications; manual specification of models becomes complicated;
besides, load and manipulation of large models is cost-effective. Machine
learning based code auditing suffers from the lack of interpretability of
results; the black-box nature of classifiers prevents understanding their
classification processes. The use of gray-box classifiers such as J48 used in
[92] may alleviate this issue since paths can be extracted from trained models
which enables the understandability of the classification scheme. Static
taint-analysis suffers from the inability to handle dynamically generated
scripts at browsers which is a common practice that is widely used in advanced
web applications. In the other side, dynamic analysis has also some
limitations; as the number of injection points increases, it takes longer to
detect all XSS vulnerabilities. Moreover, it produces high false negatives due
to their reliance on a set of payloads that are often unable to cover all
possible paths. Despite the extensive interest in test-case generation, those
techniques are still ineffective for the detection of all real-world scenarios
specially with the use of obfuscations. Hybrid analysis provides a trade-off
between static and dynamic analysis, however only three studies are found in
the literature, thereby we advocate more studies in this direction. Moreover,
much interest should be given to handle vulnerability flaws across multiple
pages; only few studies are addressing such an issue.

###  9.3 Bias of interest toward basic XSS attacks

Several XSS attack types are reported and explored in the literature. However,
the different types are not treated equally. The study revealed a bias toward
the three basic attacks (i.e., RXSS, SXSS and DXSS). The other attacks are not
sufficiently studied and more attacks may be in the way. This can be justified
by the fact that basic attacks are well-recognized by web security communities
and are well-documented. The experience showed that no single solution is able
to handle all the attack types, hence more appropriate solutions should be
explored to defend against other variants of XSS attacks.

###  9.4 Limitations of attack detection techniques

The study revealed that machine learning is the widely explored approach for
the detection of XSS attacks. We agree that machine learning is a promising
approach for the detection of cybersecurity attacks including XSS. However,
three main obstacles hinder their usage in practice: lack of interpretability
of their predictions, their susceptibility to adversarial attacks and lack of
benchmarks [176, 177]. The effective adoption of machine learning for
cybersecurity attack detection requires to properly mitigate these three
problems. In the review, only two studies have been found addressing the
interpretability of their proposed models [118, 154]. In [118], Bayes Networks
are adopted since they provide clear semantics that enable learning
probability distributions from data [178]. In [154], the authors proposed
deriving explainable rules from black-box models that make the predictions
generative and explainable. The latter approach is limited to models using
binary features which does not fit to all discriminating features explored in
the literature. Regarding susceptibility to adversarial attacks, only four
studies addressed the issue, reinforcement learning is the most adopted
solution to improve the performance of machine learning models through
learning and generation of adversarial attack vectors and retrain models on
those attacks. More techniques should be explored in this direction.
Additionally, benchmarking is a long standing problem for machine learning
based proposals. Benchmarks enable fair comparison of existing solutions and
the development of more robust models [177]. In [133], the authors cooperate
by proposing a new oversampling algorithm for XSS datasets. More researches
are also advocated to deal with such problem.

###  9.5 Limitations of attack defense techniques

Due to the rapid development of attack tactics, traditional filtering
techniques such as white/blacklist, Regex pattern matching become inefficient
for the detection of all XSS attacks. They need to be frequently updated
whenever new attack vectors are reported. Surprisingly, despite the prevalence
of web applications with file upload capabilities, such as online social
networks, upload filtering is getting less attention. Only two studies covered
the issue but with unsupported limitations [34, 47]. We advocate more studies
that explore properly the upload filtering technique. In the other side,
content security policies (CSP) is a powerful and robust filtering solution,
if used properly, to defend against XSS attacks. The ideal solution requires
to deal with scalability, compatibility, dynamic generation of elements and
automatic generation of policies. Those issues are partially addressed by
contemporary studies. The study of Xu et al. [138] is the only contribution
targeting the scalability issue of CSP policies where fine-grained rules are
enabled by the proposed solution. Fine-grained policies enable the
specification of allowed and/or blocked scripts at elementary and specific
tags. The automatic generation of CSP policies for web applications is also
mandatory for two reasons: (1) avoid potential errors caused by manual
specifications and (2) handle complex and large scale web applications. The
automatic generation is addressed in [62, 76, 84]. However, those solutions
have several limitations related to high false positive rates and performance
overheads. Therefore, more improvements are required to reach the ideal CSP
policy based solution. Moreover, dealing with dynamic element integration is
mainly treated by blacklisting the eval() function such in [138]. The same
problem is faced by MTD based techniques. More solutions should be explored
such as adopting effective combinations of static and dynamic analysis for the
automatic generation of policies. This way, dynamically added elements can be
covered by policies as well as randomization mechanisms used by MTD based
approaches. There is still an obstacle facing the effectiveness of CSP
policies which is their susceptibilities to CR-XSS attacks. Consequently, more
studies are needed to explore how to cope with CR-XSS attacks in CSP based
policies.

###  9.6 Bias toward JavaScript based XSS

Cross-site scripting attacks are primarily caused by the execution of injected
malicious scripts making benefits of unsanitized input data. Those scripts are
not necessary written in JavaScript, other scripting languages such as
VBScript, ActiveX, Flash, and even CSS can be used. However, a remarkable bias
is shown toward XSS attacks caused by JavaScripts. The bias is understandable
because of the popularity of JavaScript. However, for completeness and
robustness, other XSS vectors written in other scripting languages should also
be taken into account. An initiative was taken in [27], by preventing the
execution of scripts embedded on Flash objects. Bensalim et al. [156] also
considered attacks that can come from embedding scripts into JSON files. More
deep investigations are required to deal with all XSS attack vectors. In
addition, dealing with HTML5 specific features when designing new defense
mechanisms starts getting much attention. Fifteen included studies proposed
defense mechanisms that also work with HTML5 embedded attacks [109, 135, 152,
156]. Developers of new defense attacks should follow the same path.

##  10 Threats to validity

This section discusses the validity threats of our conducted study. As
suggested by Ampatzoglou et al. [179], we discuss three types of threats to
validity (study selection, data, research) and we show how we struggled to
mitigate them.

###  10.1 Study selection validity

The identification of relevant papers is the key point of any secondary study.
To avoid missing relevant papers, we queried six well-known academic libraries
in the field. In addition to those suggested by Kuhrmann et al. [12], we also
searched papers in Scopus. The automatic search process is based on the
presence of search keywords in titles only. Since this may affect the results,
we completed the search with exhaustive and recursive snowballing considering
titles and abstracts. At the end of the search process, a separate automatic
search was made with Google Scholar and no additional relevant papers were
retrieved. After relevance and inclusion/exclusion criteria check, we
conducted a strict quality assessment process. This was the cause of the
elimination of a great number of studies. However, we believe that our quality
assessment criteria were objective. We did not penalize early publications for
their number of citations and we used recognized sources for ranking. In
addition, each of the other criterion was adopted for a specific purpose as
discussed in section 2.3.2. The only limitation that can be reported for study
selection is the ignorance of non-academic studies. The problem is caused by
the absence of well-recognized sources and the need for different quality
assessment criteria for grey literature such as technical reports and feature
papers.

###  10.2 Study data validity

Data extraction from included studies is performed and checked separately by
the authors. This enabled the identification of potential inconsistencies.
When they appear, the authors performed a second check and conflicts are
resolved after discussion. In addition, concise templates are used for
extraction, this is designed by the authors at the planning phase before
conducting the review.

###  10.3 Study research validity

The results derived from the present study only concerns high quality
published studies in academic repositories. Grey literature, non-English and
low quality papers are excluded from the review. Specifically several non-
English and low-quality papers were found published in the literature,
however, sticking to the adopted protocol, those studies were excluded.

##  11 Conclusion

In this paper, we conducted a systematic mapping and a comprehensive survey
studying the advancement in research to tackle XSS attacks. The study is not
restricted to a period of time and covered high quality studies published
since its discovery. Several studies were found in the literature but a
remarkable interest is only observed in the last few years. Despite the
diversity of solutions proposed over the years, XSS attacks are still
prevalent and targeting new web applications and platforms. The study revealed
much attention to XSS vulnerability detection instead of its repair. For
securing web navigation, several defense lines should be provided. As a
staring point, developers need to be aware of the consequences resulted from
ignoring security practices, at the same time, effective tools enabling the
automatic detection and repair of XSS vulnerabilities should be made available
to facilitate their tasks. Dynamic defense techniques against XSS attacks
should also be provided for protecting innocent users when new attacks occur,
those techniques are still immature for providing the intended protection
level against all types of XSS attacks [180]. Traditional filtering approaches
become ineffective regarding the new developed web technologies, more advanced
techniques need to be explored. Although the wide adoption of machine learning
based techniques for the detection of XSS attacks, existing endeavors only
focus on performance analysis omitting three important problems related to
cyber-security communities (1) interpretability of prediction results, (2)
robustness of models against adversarial attacks and (3) suitability for
integration in real-world architectures and platforms. The review also denoted
a bias toward basic XSS attacks; this needs to be alleviated by advocating
more research targeting other XSS attack variants, specifically WXSS and XAS
that are targeting online social networks that may affect wider populations in
a short period of time. Moreover, regarding the rapid development of web
technologies, XSS attacks written in other scripting languages such VBScript
and ActiveX or embedded in advanced web languages such as HTML5 need to
properly be studied for completeness and robustness.

## References

  * [1] V. K. Malviya, S. Saurav, A. Gupta, On security issues in web applications through cross site scripting (xss), in: Proceedings of the 20th Asia-Pacific Software Engineering Conference, APSEC, IEEE, Bangkok, Thailand, 2013, pp. 583–588.  doi:10.1109/APSEC.2013.85.
  * [2] I. Hydara, A. B. M. Sultan, H. Zulzalil, N. Admodisastro, Current state of research on cross-site scripting (xss) – a systematic literature review, Information and Software Technology 58 (2015) 170–186.  doi:10.1016/j.infsof.2014.07.010.
  * [3] V. Nithya, S. L. Pandian, C. Malarvizhi, A survey on detection and prevention of cross-site scripting attack, International Journal of Security and Its Applications 9 (3) (2015) 139–152.  doi:10.14257/ijsia.2015.9.3.14.
  * [4] G. Deepa, P. S. Thilagam, Securing web applications from injection and logic vulnerabilities: Approaches and challenges, Information and Software Technology 74 (2016) 160–180.  doi:10.1016/j.infsof.2016.02.005.
  * [5] S. Gupta, B. B. Gupta, Cross-site scripting (xss) attacks and defense mechanisms: classification and state-of-the-art, International Journal of System Assurance Engineering and Management 8 (1) (2017) 512–530.  doi:10.1007/s13198-015-0376-0.
  * [6] P. Chaudhary, B. Gupta, Plague of cross-site scripting on web applications: a review, taxonomy and challenges, International Journal of Web Based Communities 14 (1) (2018) 64–93.  doi:10.1504/IJWBC.2018.090916.
  * [7] U. Sarmah, D. Bhattacharyya, J. Kalita, A survey of detection methods for xss attacks, Journal of Network and Computer Applications 118 (2018) 113–143.  doi:10.1016/j.jnca.2018.06.004.
  * [8] S. Gupta, B. B. Gupta, Evaluation and monitoring of xss defensive solutions: a survey, open research issues and future directions, Journal of Ambient Intelligence and Humanized Computing 10 (11) (2019) 4377–4405.  doi:10.1007/s12652-018-1118-3.
  * [9] M. Liu, B. Zhang, W. Chen, X. Zhang, A survey of exploitation and detection methods of xss vulnerabilities, IEEE Access 7 (2019) 182004–182016.  doi:10.1109/ACCESS.2019.2960449.
  * [10] G. E. Rodríguez, J. G. Torres, P. Flores, D. E. Benavides, Cross-site scripting (xss) attacks and mitigation: A survey, Computer Networks 166 (2020) 106960.  doi:10.1016/j.comnet.2019.106960.
  * [11] B. A. Kitchenham, D. Budgen, P. Brereton, Evidence-Based Software Engineering and Systematic Reviews, Chapman & Hall/CRC, 2015.
  * [12] M. Kuhrmann, D. M. Fernández, M. Daneva, On the pragmatic design of literature studies in software engineering: an experience-based guideline, Empirical Software Engineering 22 (6) (2017) 2852–2891.  doi:10.1007/s10664-016-9492-y.
  * [13] C. Wohlin, Second-generation systematic literature studies using snowballing, in: Proceedings of the 20th International Conference on Evaluation and Assessment in Software Engineering, EASE, ACM, Limerick, Ireland, 2016, pp. 1–6.  doi:10.1145/2915970.2916006.
  * [14] K. Petersen, R. Feldt, S. Mujtaba, M. Mattsson, Systematic mapping studies in software engineering, in: Proceedings of the 12th International Conference on Evaluation and Assessment in Software Engineering, EASE, ACM, Bari, Italy, 2008, pp. 68–77.
  * [15] D. S. Cruzes, T. Dybå, Research synthesis in software engineering: A tertiary study, Information and Software Technology 53 (5) (2011) 440–455.  doi:10.1016/j.infsof.2011.01.004.
  * [16] Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, S.-Y. Kuo, Securing web application code by static analysis and runtime protection, in: Proceedings of the 13th International Conference on World Wide Web, WWW, ACM, New York, NY, USA, 2004, pp. 40–52.  doi:10.1145/988672.988679.
  * [17] N. Jovanovic, C. Kruegel, E. Kirda, Pixy: A static analysis tool for detecting web application vulnerabilities, in: Proceedings of the 2006 IEEE Symposium on Security and Privacy, SP, IEEE, Berkeley/Oakland, CA, USA, 2006, pp. 1–6.  doi:10.1109/SP.2006.29.
  * [18] J. Shanmugam, M. Ponnavaikko, A solution to block cross site scripting vulnerabilities based on service oriented architecture, in: Proceedings of the 6th IEEE/ACIS International Conference on Computer and Information Science, ICIS 2007; 1st IEEE/ACIS International Workshop on e-Activity, IWEA, IEEE, Melbourne, VIC, Australia, 2007, pp. 861–866.  doi:10.1109/ICIS.2007.45.
  * [19] J. Shanmugam, M. Ponnavaikko, Behavior-based anomaly detection on the server side to reduce the effectiveness of cross site scripting vulnerabilities, in: Proceedings of the 3rd International Conference on Semantics, Knowledge, and Grid, SKG, IEEE, Xi’an, China, 2007, pp. 350–353.  doi:10.1109/SKG.2007.63.
  * [20] P. Vogt, F. Nentwich, N. Jovanovic, E. Kirda, C. Kruegel, G. Vigna, Cross site scripting prevention with dynamic data tainting and static analysis., in: Proceedings of the Network and Distributed System Security Symposium, NDSS, The Internet Society, San Diego, California, USA, 2007, pp. 1–12.
  * [21] T. Jim, N. Swamy, M. Hicks, Defeating script injection attacks with browser-enforced embedded policies, in: Proceedings of the 16th international conference on World Wide Web, WWW, ACM, Banff, Alberta, Canada, 2007, pp. 601–610.  doi:10.1145/1242572.1242654.
  * [22] M. Martin, M. Lam, Automatic generation of xss and sql injection attacks with goal-directed model checking, in: Proceedings of the 17th USENIX Security Symposium, USENIX, USENIX, San Jose, CA, USA, 2008, pp. 31–43.
  * [23] S. McAllister, E. Kirda, C. Kruegel, Leveraging user interactions for in-depth testing of web applications, in: International Workshop on Recent Advances in Intrusion Detection, RAID, Springer, Cambridge, MA, USA, 2008, pp. 191–210.  doi:10.1007/978-3-540-87403-4_11.
  * [24] D. Balzarotti, M. Cova, V. Felmetsger, N. Jovanovic, E. Kirda, C. Kruegel, G. Vigna, Saner: Composing static and dynamic analysis to validate sanitization in web applications, in: Proceedings of the 2008 IEEE Symposium on Security and Privacy, SP, IEEE, Oakland, CA, USA, 2008, pp. 387–401.  doi:10.1109/SP.2008.22.
  * [25] G. Wassermann, Z. Su, Static detection of cross-site scripting vulnerabilities, in: Proceedings of the ACM/IEEE 30th International Conference on Software Engineering, ICSE, ACM, Leipzig, Germany, 2008, pp. 171–180.  doi:10.1145/1368088.1368112.
  * [26] M. Johns, B. Engelmann, J. Posegga, Xssds: Server-side detection of cross-site scripting attacks, in: Proceedings of the Annual Computer Security Applications Conference, ACSAC, IEEE, Anaheim, CA, USA, 2008, pp. 335–344.  doi:10.1109/ACSAC.2008.36.
  * [27] V. V. N. Bisht Prithvi, Xss-guard: Precise dynamic prevention of cross-site scripting attacks, in: Proceedings of the 5th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA, Springer, Paris, France, 2008, pp. 23–43.  doi:10.1007/978-3-540-70542-0_2.
  * [28] G. Iha, H. Doi, An implementation of the binding mechanism in the web browser for preventing xss attacks: Introducing the bind-value headers, in: Proceedings of the International Conference on Availability, Reliability and Security, ARES, IEEE, Fukuoka, Japan, 2009, pp. 966–971.  doi:10.1109/ARES.2009.19.
  * [29] A. Kiezun, P. Guo, K. Jayaraman, M. Ernst, Automatic creation of sql injection and cross-site scripting attacks, in: Proceedings of the International Conference on Software Engineering, ICSE, IEEE, Vancouver, BC, Canada, 2009, pp. 199–209.  doi:10.1109/ICSE.2009.5070521.
  * [30] M. T. Louw, V. Venkatakrishnan, Blueprint: Robust prevention of cross-site scripting attacks for existing browsers, in: Proceedings of the 30th IEEE Symposium on Security and Privacy, SP, IEEE, Oakland, CA, USA, 2009, pp. 331–346.  doi:10.1109/SP.2009.33.
  * [31] E. Kirda, N. Jovanovic, C. Kruegel, G. Vigna, Client-side cross-site scripting protection, Computers and Security 28 (7) (2009) 592–604.  doi:10.1016/j.cose.2009.04.008.
  * [32] F. Sun, L. Xu, Z. Su, Client-side detection of xss worms by monitoring payload propagation, in: Proceedings of the 2009 European Symposium on Research in Computer Security, ESORICS, Springer, Saint-Malo, France, 2009, pp. 539–554.  doi:10.1007/978-3-642-04444-1_33.
  * [33] Y. Nadji, P. Saxena, D. Song, Document structure integrity: A robust basis for cross-site scripting defense, in: Proceedings of the 16th Annual Network and Distributed System Security Symposium, Vol. 20 of NDSS, The Internet Society, San Diego, California, USA, 2009, pp. 1–20.
  * [34] A. Barth, J. Caballero, D. Song, Secure content sniffing for web browsers, or how to stop papers from reviewing themselves, in: 2009 30th IEEE Symposium on Security and Privacy, SP, IEEE, Oakland, CA, USA, 2009, pp. 360–371.  doi:10.1109/SP.2009.3.
  * [35] P. Wurzinger, C. Platzer, C. Ludl, E. Kirda, C. Kruegel, Swap: Mitigating xss attacks using a reverse proxy, in: Proceedings of the 2009 ICSE Workshop on Software Engineering for Secure Systems, SESS 2009, IWSESS, IEEE, Vancouver, BC, Canada, 2009, pp. 33–39.  doi:10.1109/IWSESS.2009.5068456.
  * [36] M. Gebre, K.-S. Lhee, M. Hong, A robust defense against content-sniffing xss attacks, in: Proceeding of the 6th International Conference on Digital Content, Multimedia Technology and Its Applications, IDC, IEEE, Seoul, South Korea, 2010, pp. 315–320.
  * [37] D. Bates, A. Barth, C. Jackson, Regular expressions considered harmful in client-side xss filters, in: Proceedings of the 19th International Conference on World Wide Web, WWW, ACM, Raleigh, North Carolina, USA, 2010, pp. 91–99.  doi:10.1145/1772690.1772701.
  * [38] S. Stamm, B. Sterne, G. Markham, Reining in the web with content security policy, in: Proceedings of the 19th international conference on World Wide Web, WWW, ACM, Raleigh, North Carolina, USA, 2010, pp. 921–930.  doi:10.1145/1772690.1772784.
  * [39] E. Athanasopoulos, V. Pappas, A. Krithinakis, S. Ligouras, E. P. Markatos, T. Karagiannis, Xjs: Practical xss prevention for web application development, in: Proceedings of the 2010 USENIX Conference on Web Application Development, WebApps, USENIX, Boston, MA, USA, 2010, pp. 1–13.
  * [40] J. Weinberger, P. Saxena, D. Akhawe, M. Finifter, R. Shin, D. Song, A systematic analysis of xss sanitization in web application frameworks, in: Proceedings of the European Symposium on Research in Computer Security, ESORICS, Springer, Leuven, Belgium, 2011, pp. 150–171.  doi:10.1007/978-3-642-23822-2_9.
  * [41] M. Samuel, P. Saxena, D. Song, Context-sensitive auto-sanitization in web templating languages using type qualifiers, in: Proceedings of the 18th ACM conference on Computer and communications security, CCS, ACM, Chicago, Illinois, USA, 2011, pp. 587–600.  doi:10.1145/2046707.2046775.
  * [42] P. Hooimeijer, B. Livshits, D. Molnar, P. Saxena, M. Veanes, Fast and precise sanitizer analysis with $\\{$BEK$\\}$, in: Proceedings of the 20th USENIX Security Symposium, USENIX, USENIX, San Francisco, CA, USA, 2011, pp. 1–16.
  * [43] R. Mui, P. Frankl, Preventing web application injections with complementary character coding, in: Proceedings of the European Symposium on Research in Computer Security, ESORICS, Springer, Leuven, Belgium, 2011, pp. 80–99.  doi:10.1007/978-3-642-23822-2_5.
  * [44] Y. Wang, Z. Li, T. Guo, Program slicing stored xss bugs in web application, in: Proceedings of the 5th International Conference on Theoretical Aspects of Software Engineering, TASE, IEEE, Xi’an, China, 2011, pp. 191–194.  doi:10.1109/TASE.2011.43.
  * [45] H. Shahriar, M. Zulkernine, S2xs2: A server side approach to automatically detect xss attacks, in: Proceedings of the IEEE 9th International Conference on Dependable, Autonomic and Secure Computing, DASC, IEEE, Sydney, NSW, Australia, 2011, pp. 7–14.  doi:10.1109/DASC.2011.26.
  * [46] A. Avancini, M. Ceccato, Security testing of web applications: A search-based approach for cross-site scripting vulnerabilities, in: Proceedings of the 11th International Working Conference on Source Code Analysis and Manipulation, SCAM, IEEE, Williamsburg, VA, USA, 2011, pp. 85–94.  doi:10.1109/SCAM.2011.7.
  * [47] A. Barua, H. Shahriar, M. Zulkernine, Server side detection of content sniffing attacks, in: Proceedings of the 22nd International Symposium on Software Reliability Engineering, ISSRE, IEEE, Hiroshima, Japan, 2011, pp. 20–29.  doi:10.1109/ISSRE.2011.27.
  * [48] T. Scholte, W. Robertson, D. Balzarotti, E. Kirda, An empirical analysis of input validation mechanisms in web applications and languages, in: Proceedings of the 27th Annual ACM Symposium on Applied Computing, SAC, ACM, Trento, Italy, 2012, pp. 1419–1426.  doi:10.1145/2245276.2232004.
  * [49] L. Shar, H. Tan, Auditing the xss defence features implemented in web application programs, IET Software 6 (4) (2012) 377–390.  doi:10.1049/iet-sen.2011.0084.
  * [50] L. Shar, H. Tan, Automated removal of cross site scripting vulnerabilities in web applications, Information and Software Technology 54 (5) (2012) 467–478.  doi:10.1016/j.infsof.2011.12.006.
  * [51] A. Nunan, E. Souto, E. Dos Santos, E. Feitosa, Automatic classification of cross-site scripting in web pages using document-based and url-based features, in: Proceedings of the IEEE Symposium on Computers and Communications, ISCC, IEEE, Cappadocia, Turkey, 2012, pp. 702–707.  doi:10.1109/ISCC.2012.6249380.
  * [52] S. Van Acker, N. Nikiforakis, L. Desmet, W. Joosen, F. Piessens, Flashover: Automated discovery of cross-site scripting vulnerabilities in rich internet applications, in: Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security, ASIACCS, ACM, Seoul, Korea, 2012, pp. 12–13.  doi:10.1145/2414456.2414462.
  * [53] M. Van Gundy, H. Chen, Noncespaces: Using randomization to defeat cross-site scripting attacks, Computers and Security 31 (4) (2012) 612–628.  doi:10.1016/j.cose.2011.12.004.
  * [54] Y. Cao, V. Yegneswaran, P. A. Porras, Y. Chen, Pathcutter: Severing the self-propagation path of xss javascript worms in social web networks., in: Proceedings of the Network and Distributed System Security Symposium, NDSS, The Internet Society, San Diego, California, USA, 2012, pp. 1–14.
  * [55] T. Scholte, W. Robertson, D. Balzarotti, E. Kirda, Preventing input validation vulnerabilities in web applications through automated type analysis, in: Proceedings of the 2012 IEEE 36th annual computer software and applications conference, COMPSAC, IEEE, Izmir, Turkey, 2012, pp. 233–243.  doi:10.1109/COMPSAC.2012.34.
  * [56] R. Pelizzi, R. Sekar, Protection, usability and improvements in reflected xss filters, in: Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security, ASIACCS, ACM, Seoul, South Korea, 2012, pp. 1–11.  doi:10.1145/2414456.2414458.
  * [57] S. Sundareswaran, A. Squicciarini, Xss-dec: A hybrid solution to mitigate cross-site scripting attacks, in: Proceedings of the 26th Annual IFIP Annual Conference on Data and Applications Security and Privacy, DBSec, Springer, Paris, France, 2012, pp. 223–238.  doi:10.1007/978-3-642-31540-4_17.
  * [58] S. Lekies, B. Stock, M. Johns, 25 million flows later - large-scale detection of dom-based xss, in: Proceedings of the ACM Conference on Computer and Communications Security, CCS, ACM, Berlin, Germany, 2013, pp. 1193–1204.  doi:10.1145/2508859.2516703.
  * [59] M. Faghani, U. Nguyen, A study of xss worm propagation and detection mechanisms in online social networks, IEEE Transactions on Information Forensics and Security 8 (11) (2013) 1815–1826.  doi:10.1109/TIFS.2013.2280884.
  * [60] A. Avancini, M. Ceccato, Circe: A grammar-based oracle for testing cross-site scripting in web applications, in: Proceedings of the 2013 20th Working Conference on Reverse Engineering, WCRE, IEEE, Koblenz, Germany, 2013, pp. 262–271.  doi:10.1109/WCRE.2013.6671301.
  * [61] A. Avancini, M. Ceccato, Comparison and integration of genetic algorithms and dynamic symbolic execution for security testing of cross-site scripting vulnerabilities, Information and Software Technology 55 (12) (2013) 2209–2222.  doi:10.1016/j.infsof.2013.08.001.
  * [62] A. Doupé, W. Cui, M. Jakubowski, M. Peinado, C. Kruegel, G. Vigna, Dedacota: Toward preventing server-side xss via automatic code and data separation, in: Proceedings of the ACM Conference on Computer and Communications Security, CCS, ACM, Berlin, Germany, 2013, pp. 1205–1216.  doi:10.1145/2508859.2516708.
  * [63] D. Das, U. Sharma, D. Bhattacharyya, Detection of cross-site scripting attack under multiple scenarios, Computer Journal 58 (4) (2013) 808–822.  doi:10.1093/comjnl/bxt133.
  * [64] O. Tripp, O. Weisman, L. Guy, Finding your way in the testing jungle: A learning approach to web security testing, in: Proceedings of the 2013 International Symposium on Software Testing and Analysis, ISSTA, ACM, Lugano, Switzerland, 2013, pp. 347–357.  doi:10.1145/2483760.2483776.
  * [65] F. Duchene, S. Rawat, J.-L. Richier, R. Groz, Ligre: Reverse-engineering of control and data flow models for black-box xss detection, in: Proceedings of the Working Conference on Reverse Engineering, WCRE, WCRE, IEEE, Koblenz, Germany, 2013, pp. 252–261.  doi:10.1109/WCRE.2013.6671300.
  * [66] M. Heiderich, J. Schwenk, T. Frosch, J. Magazinius, E. Z. Yang, mxss attacks: Attacking well-secured web-applications by using innerhtml mutations, in: Proceedings of the 2013 ACM SIGSAC conference on Computer and communications security, CCS, ACM, Berlin, Germany, 2013, pp. 777–788.  doi:10.1145/2508859.2516723.
  * [67] L. Shar, H. Tan, Predicting sql injection and cross site scripting vulnerabilities through mining input sanitization patterns, Information and Software Technology 55 (10) (2013) 1767–1780.  doi:10.1016/j.infsof.2013.04.002.
  * [68] A. Vernotte, F. Dadeau, F. Lebeau, B. Legeard, F. Peureux, F. Piat, Efficient detection of multi-step cross-site scripting vulnerabilities, in: Proceedings of the International Conference on Information Systems Security, ICISS, Springer, Hyderabad, India, 2014, pp. 358–377.  doi:10.1007/978-3-319-13841-1_20.
  * [69] T. Rocha, E. Souto, Etssdetector: A tool to automatically detect cross-site scripting vulnerabilities, in: Proceedings of the 2014 IEEE 13th International Symposium on Network Computing and Applications, NCA, IEEE, Cambridge, MA, USA, 2014, pp. 306–309.  doi:10.1109/NCA.2014.53.
  * [70] F. Duchene, S. Rawat, J.-L. Richier, R. Groz, Kameleonfuzz: Evolutionary fuzzing for black-box xss detection, in: Proceedings of the 4th ACM Conference on Data and Application Security and Privacy, CODASPY, ACM, San Antonio, Texas, USA, 2014, pp. 37–48.  doi:10.1145/2557547.2557550.
  * [71] R. Wang, X. Jia, Q. Li, S. Zhang, Machine learning based cross-site scripting detection in online social network, in: Proceedings of the 16th IEEE International Conference on High Performance Computing and Communications, HPCC, IEEE, Paris, France, 2014, pp. 823–826.  doi:10.1109/HPCC.2014.137.
  * [72] B. Stock, S. Lekies, T. Mueller, P. Spiegel, M. Johns, Precise client-side protection against dom-based cross-site scripting, in: Proceedings of the 23rd USENIX Security Symposium, USENIX, USENIX, San Francisco, CA, USA, 2014, pp. 655–670.
  * [73] M. Johns, Script-templates for the content security policy, Journal of Information Security and Applications 19 (3) (2014) 209–223.  doi:10.1016/j.jisa.2014.03.007.
  * [74] A. Javed, J. Schwenk, Towards elimination of cross-site scripting on mobile versions of web applications, in: Proceedings of the 14th International Workshop on Information Security Applications, WISA, Springer, Jeju Island, Korea, 2014, pp. 103–123.  doi:10.1007/978-3-319-05149-9_7.
  * [75] J. Bozic, B. Garn, I. Kapsalis, D. Simos, S. Winkler, F. Wotawa, Attack pattern-based combinatorial testing with constraints for web security testing, in: 2015 IEEE International Conference on Software Quality, Reliability and Security, QRS, IEEE, Vancouver, BC, Canada, 2015, pp. 207–212.  doi:10.1109/QRS.2015.38.
  * [76] M. Fazzini, P. Saxena, A. Orso, Autocsp: Automatically retrofitting csp to web applications, in: 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, ICSE, IEEE, Florence, Italy, 2015, pp. 336–346.  doi:10.1109/ICSE.2015.53.
  * [77] I. Parameshwaran, E. Budianto, S. Shinde, H. Dang, A. Sadhu, P. Saxena, Auto-patching dom-based xss at scale, in: Proceedings of the 2015 10th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering, ESEC/FSE, ACM, Bergamo, Italy, 2015, pp. 272–283.  doi:10.1145/2786805.2786821.
  * [78] J. Bozic, B. Garn, D. E. Simos, F. Wotawa, Evaluation of the ipo-family algorithms for test case generation in web security testing, in: Proceedings of the 2015 IEEE Eighth International Conference on Software Testing, Verification and Validation Workshops, ICSTW, IEEE, Graz, Austria, 2015, pp. 1–10.  doi:10.1109/ICSTW.2015.7107436.
  * [79] B. Stock, S. Pfistner, B. Kaiser, S. Lekies, M. Johns, From facepalm to brain bender: Exploring client-side cross-site scripting, in: Proceedings of the ACM Conference on Computer and Communications Security, CCS, ACM, Denver, Colorado, USA, 2015, pp. 1419–1430.  doi:10.1145/2810103.2813625.
  * [80] Y. Zhang, Q. Liu, Q. Luo, X. Wang, Xas: Cross-api scripting attacks in social ecosystems, Science China Information Sciences 58 (1) (2015) 1–14.  doi:10.1007/s11432-014-5145-1.
  * [81] D. Simos, K. Kleine, L. Ghandehari, B. Garn, Y. Lei, A combinatorial approach to analyzing cross-site scripting (xss) vulnerabilities in web application security testing, in: Proceedings of the International Conference on Testing Software and Systems, ICSS, Springer, Graz, Austria, 2016, pp. 70–85.  doi:10.1007/978-3-319-47443-4_5.
  * [82] S. Gupta, B. B. Gupta, An infrastructure-based framework for the alleviation of javascript worms from osn in mobile cloud platforms, in: International conference on network and system security, NSS, Springer, Taipei, Taiwan, 2016, pp. 98–109.  doi:10.1007/978-3-319-46298-1_7.
  * [83] L. Weichselbaum, M. Spagnuolo, S. Lekies, A. Janc, Csp is dead, long live csp! on the insecurity of whitelists and the future of content security policy, in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS, ACM, Vienna, Austria, 2016, pp. 1376–1387.  doi:10.1145/2976749.2978363.
  * [84] X. Pan, Y. Cao, S. Liu, Y. Zhou, Y. Chen, T. Zhou, Cspautogen: Black-box enforcement of content security policy upon real-world websites, in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS, ACM, Vienna, Austria, 2016, pp. 653–665.  doi:10.1145/2976749.2978384.
  * [85] J. Pan, X. Mao, Domxssmicro: A micro benchmark for evaluating dom-based cross-site scripting detection, in: Proceedings of the IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom, IEEE, Tianjin, China, 2016, pp. 208–215.  doi:10.1109/TrustCom.2016.0065.
  * [86] D. Mitropoulos, K. Stroggylos, D. Spinellis, A. Keromytis, How to train your browser: Preventing xss attacks using contextual script fingerprints, ACM Transactions on Privacy and Security 19 (1) (2016) 1–31.  doi:10.1145/2939374.
  * [87] A. Steinhauser, F. Gauthier, Jspchecker: Static detection of context-sensitive cross-site scripting flaws in legacy web applications, in: Proceedings of the 2016 ACM Workshop on Programming Languages and Analysis for Security, PLAS, ACM, Vienna, Austria, 2016, pp. 57–68.  doi:10.1145/2993600.2993606.
  * [88] M. A. Ahmed, F. Ali, Multiple-path testing for cross site scripting using genetic algorithms, Journal of Systems Architecture 64 (2016) 50–62.  doi:10.1016/j.sysarc.2015.11.001.
  * [89] A. Lin, P. Barceló, String solving with word equations and transducers: Towards a logic for analysing mutation xss, in: Proceedings of the 43rd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL, ACM, St. Petersburg, FL, USA, 2016, pp. 123–136.  doi:10.1145/2837614.2837641.
  * [90] F. Yan, T. Qiao, Study on the detection of cross-site scripting vulnerabilities based on reverse code audit, in: Proceedings of the 17th International Conference on Intelligent Data Engineering and Automated Learning, IDEAL, Springer, Yangzhou, China, 2016, pp. 154–163.  doi:10.1007/978-3-319-46257-8_17.
  * [91] J. Pan, X. Mao, W. Li, Taint inference for cross-site scripting in context of url rewriting and html sanitization, ETRI Journal 38 (2) (2016) 376–386.  doi:10.4218/etrij.16.0115.0570.
  * [92] M. Gupta, M. Govil, G. Singh, Text-mining based predictive model to detect xss vulnerable files in web applications, in: Poroceedings of the 12th IEEE International Conference Electronics, Energy, Environment, Communication, Computer, Control, INDICON, IEEE, New Delhi, India, 2016, pp. 1–6.  doi:10.1109/INDICON.2015.7443332.
  * [93] E. Bazzoli, C. Criscione, F. Maggi, S. Zanero, Xss peeker: Dissecting the xss exploitation techniques and fuzzing mechanisms of blackbox web application scanners, in: Proceedings of the 31st IFIP International Conference on ICT Systems Security and Privacy Protection, SEC, Springer, Ghent, Belgium, 2016, pp. 243–258.  doi:10.1007/978-3-319-33630-5_17.
  * [94] S. Gupta, B. Gupta, Xss-immune: a google chrome extension-based xss defensive framework for contemporary platforms of web applications, Security and Communication Networks 9 (17) (2016) 3966–3986.  doi:10.1002/sec.1579.
  * [95] S. Gupta, B. Gupta, Xss-safe: A server-side approach to detect and mitigate cross-site scripting (xss) attacks in javascript code, Arabian Journal for Science and Engineering 41 (3) (2016) 897–920.  doi:10.1007/s13369-015-1891-7.
  * [96] S. Goswami, N. Hoque, D. Bhattacharyya, J. Kalita, An unsupervised method for detection of xss attack, International Journal of Network Security 19 (5) (2017) 761–775.  doi:10.6633/IJNS.201709.19(5).14.
  * [97] S. Lekies, K. Kotowicz, S. Grob, E. Nava, M. Johns, Code-reuse attacks for theweb: Breaking cross-site scripting mitigations via script gadgets, in: Proceedings of the ACM Conference on Computer and Communications Security, CCS, ACM, Dallas, Texas, USA, 2017, pp. 1709–1723.  doi:10.1145/3133956.3134091.
  * [98] M. Mohammadi, B. Chu, H. Lipford, Detecting cross-site scripting vulnerabilities through automated unit testing, in: Proceedings of the 2017 IEEE International Conference on Software Quality, Reliability and Security, QRS, IEEE, Prague, Czech Republic, 2017, pp. 364–373.  doi:10.1109/QRS.2017.46.
  * [99] J. Pan, X. Mao, Detecting dom-sourced cross-site scripting in browser extensions, in: Proceedings of the 2017 IEEE International Conference on Software Maintenance and Evolution, ICSME, IEEE, Shanghai, China, 2017, pp. 24–34.  doi:10.1109/ICSME.2017.11.
  * [100] A. Marashdih, Z. Zaaba, Detection and removing cross site scripting vulnerability in php web application, in: Proceedings of the 2017 International Conference on Promising Electronic Technologies, ICPET, IEEE, Deir El-Balah, Palestine, 2017, pp. 26–31.  doi:10.1109/ICPET.2017.11.
  * [101] M. Heiderich, C. Späth, J. Schwenk, Dompurify: Client-side protection against xss and markup injection, in: Proceedings of the 2017 European Symposium on Research in Computer Security, ESORICS, Springer, Oslo, Norway, 2017, pp. 116–134.  doi:10.1007/978-3-319-66399-9_7.
  * [102] S. Gupta, B. Gupta, Smart xss attack surveillance system for osn in virtualized intelligence network of nodes of fog computing, International Journal of Web Services Research 14 (4) (2017) 1–32.  doi:10.4018/IJWSR.2017100101.
  * [103] A. W. Marashdih, Z. F. Zaaba, H. K. Omer, Web security: detection of cross site scripting in php web application using genetic algorithm, International Journal of Advanced Computer Science and Applications 8 (5) (2017) 64–75.  doi:10.14569/IJACSA.2017.080509.
  * [104] S. Rathore, P. Sharma, J. Park, Xssclassifier: An efficient xss attack detection approach based on machine learning classifier on snss, Journal of Information Processing Systems 13 (4) (2017) 1014–1028.  doi:10.3745/JIPS.03.0079.
  * [105] B. Ayeni, J. Sahalu, K. Adeyanju, Detecting cross-site scripting in web applications using fuzzy inference system, Journal of Computer Networks and Communications 2018 (2018) 1–10.  doi:10.1155/2018/8159548.
  * [106] S. Gupta, B. Gupta, P. Chaudhary, Hunting for dom-based xss vulnerabilities in mobile cloud-based online social network, Future Generation Computer Systems 79 (2018) 319–336.  doi:10.1016/j.future.2017.05.038.
  * [107] F. Mereani, J. Howe, Preventing cross-site scripting attacks by combining classifiers, in: Proceedings of the 10th International Joint Conference on Computational Intelligence, IJCCI, SciTePress, Seville, Spain, 2018, pp. 135–143.  doi:10.5220/0006894901350143.
  * [108] W. Melicher, A. Das, M. Sharif, L. Bauer, L. Jia, Riding out domsday: Towards detecting and preventing dom cross-site scripting, in: Proceedings of the Network and Distributed System Security Symposium, NDSS, The Internet Society, San Diego, California, USA, 2018, pp. 1–15.  doi:10.14722/ndss.2018.23309.
  * [109] S. Gupta, B. Gupta, Robust injection point-based framework for modern applications against xss vulnerabilities in online social networks, International Journal of Information and Computer Security 10 (2-3) (2018) 170–200.  doi:10.1504/IJICS.2018.091455.
  * [110] R. Wang, G. Xu, X. Zeng, X. Li, Z. Feng, Tt-xss: A novel taint tracking based dynamic detection framework for dom cross-site scripting, Journal of Parallel and Distributed Computing 118 (2018) 100–106.  doi:10.1016/j.jpdc.2017.07.006.
  * [111] K. Yamazaki, D. Kotani, Y. Okabe, Xilara: An xss filter based on html template restoration, in: Proceedings of the 14th International Conference on Security and Privacy in Communication Systems, SecureComm, Springer, Singapore, Singapore, 2018, pp. 332–351.  doi:10.1007/978-3-030-01704-0_18.
  * [112] S. Lalia, A. Sarah, Xss attack detection approach based on scripts features analysis, in: Proceedings of the 2018 World Conference on Information Systems and Technologies, WorldCIST, Springer, Naples, Italy, 2018, pp. 197–207.  doi:10.1007/978-3-319-77712-2_19.
  * [113] S. Gupta, B. Gupta, Xss-secure as a service for the platforms of online social network-based multimedia web applications in cloud, Multimedia Tools and Applications 77 (4) (2018) 4829–4861.  doi:10.1007/s11042-016-3735-1.
  * [114] S. Gupta, B. Gupta, P. Chaudhary, A client-server javascript code rewriting-based framework to detect the xss worms from online social network, Concurrency and Computation: Practice and Experience 31 (21) (2019) 1–20.  doi:10.1002/cpe.4646.
  * [115] B. Garn, M. Radavelli, A. Gargantini, M. Leithner, D. Simos, A fault-driven combinatorial process for model evolution in xss vulnerability detection, in: Proceedings of the International Conference on Industrial, Engineering and Other Applications of Applied Intelligent Systems, IEA/AIE, Springer, Graz, Austria, 2019, pp. 207–215.  doi:10.1007/978-3-030-22999-3_19.
  * [116] P. Chaudhary, B. Gupta, S. Gupta, A framework for preserving the privacy of online users against xss worms on online social network, International Journal of Information Technology and Web Engineering 14 (1) (2019) 85–111.  doi:10.4018/IJITWE.2019010105.
  * [117] C. Lv, L. Zhang, F. Zeng, J. Zhang, Adaptive random testing for xss vulnerability, in: Proceedings of the 26th Asia-Pacific Software Engineering Conference, APSEC, IEEE, Putrajaya, Malaysia, 2019, pp. 63–69.  doi:10.1109/APSEC48747.2019.00018.
  * [118] Y. Zhou, P. Wang, An ensemble learning approach for xss attack detection with domain knowledge and threat intelligence, Computers and Security 82 (2019) 261–269.  doi:10.1016/j.cose.2018.12.016.
  * [119] J. Zhang, Y.-T. Jou, X. Li, Cross-site scripting (xss) detection integrating evidences in multiple stages, in: Proceedings of the Annual Hawaii International Conference on System Sciences, HICSS, AIS Electronic Library, Grand Wailea, Maui, Hawaii, USA, 2019, pp. 7166–7175.  doi:10.24251/HICSS.2019.860.
  * [120] A. Steinhauser, P. Tůma, Djangochecker: Applying extended taint tracking and server side parsing for detection of context-sensitive xss flaws, Software - Practice and Experience 49 (1) (2019) 130–148.  doi:10.1002/spe.2649.
  * [121] M. Steffens, C. Rossow, M. Johns, B. Stock, Don’t trust the locals: Investigating the prevalence of persistent client-side cross-site scripting in the wild, in: Proceedings of the Network and Distributed System Security Symposium, NDSS, The Internet Society, San Diego, California, USA, 2019, pp. 1–15.  doi:10.14722/ndss.2019.23009.
  * [122] C. Wijayarathna, N. Arachchilage, Fighting against xss attacks: A usability evaluation of owasp esapi output encoding, in: Proceedings of the 52th Annual Hawaii International Conference on System Sciences, HICSS, AIS Electronic Library, Grand Wailea, Maui, Hawaii, USA, 2019, pp. 7302–7311.  doi:10.24251/HICSS.2019.877.
  * [123] S. Chaliasos, G. Metaxopoulos, G. Argyros, D. Mitropoulos, Mime artist: Bypassing whitelisting for the web with javascript mimicry attacks, in: Proceedings of the European Symposium on Research in Computer Security, ESORICS, Springer, Luxembourg City, Luxembourg, 2019, pp. 565–585.  doi:10.1007/978-3-030-29962-0_27.
  * [124] F. Mokbal, W. Dan, A. Imran, L. Jiuchuan, F. Akhtar, W. Xiaoxi, Mlpxss: An integrated xss-based attack detection scheme in web applications using multilayer perceptron technique, IEEE Access 7 (2019) 100567–100580.  doi:10.1109/ACCESS.2019.2927417.
  * [125] J. Iqbal, R. Kaur, N. Stakhanova, Polidom: Mitigation of dom-xss by detection and prevention of unauthorized dom tampering, in: Proceedings of the 14th International Conference on Availability, Reliability and Security, ARES, ACM, Canterbury, CA, UK, 2019, pp. 1–10.  doi:10.1145/3339252.3339257.
  * [126] D. Simos, B. Garn, J. Zivanovic, M. Leithner, Practical combinatorial testing for xss detection using locally optimized attack models, in: Proceedings of the 2019 IEEE 12th International Conference on Software Testing, Verification and Validation Workshops, ICSTW, IEEE, Xi’an, China, 2019, pp. 122–130.  doi:10.1109/ICSTW.2019.00040.
  * [127] Y. Fang, C. Huang, Y. Xu, Y. Li, Rlxss: Optimizing xss detection model to defend against adversarial attacks based on reinforcement learning, Future Internet 11 (8) (2019) 1–13.  doi:10.3390/fi11080177.
  * [128] M. Musch, M. Steffens, S. Roth, B. Stock, M. Johns, Scriptprotect: mitigating unsafe third-party javascript practices, in: Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security, ASIACCS, ACM, Auckland, New Zealand, 2019, pp. 391–402.  doi:10.1145/3321705.3329841.
  * [129] A. Niakanlahiji, J. Jafarian, Webmtd: Defeating cross-site scripting attacks using moving target defense, Security and Communication Networks 2019 (2019) 1–13.  doi:10.1155/2019/2156906.
  * [130] R. Kadhim, M. Gaata, A hybrid of cnn and lstm methods for securing web application against cross-site scripting attack, Indonesian Journal of Electrical Engineering and Computer Science 21 (2) (2020) 1022–1029.  doi:10.11591/ijeecs.v21.i2.pp1022-1029.
  * [131] X. Zhang, Y. Zhou, S. Pei, J. Zhuge, J. Chen, Adversarial examples detection for xss attacks based on generative adversarial networks, IEEE Access 8 (2020) 10989–10996.  doi:10.1109/ACCESS.2020.2965184.
  * [132] C. Li, Y. Wang, C. Miao, C. Huang, Cross-site scripting guardian: A static xss detector based on data stream input-output association mining, Applied Sciences (Switzerland) 10 (14) (2020) 1–20.  doi:10.3390/app10144740.
  * [133] F. Mokbal, D. Wang, X. Wang, L. Fu, Data augmentation-based conditional wasserstein generative adversarial network-gradient penalty for xss attack detection system, PeerJ Computer Science 6 (2020) 1–20.  doi:10.7717/peerj-cs.328.
  * [134] A. Steinhauser, P. Tůma, Database traffic interception for graybox detection of stored and context-sensitive xss, Digital Threats: Research and Practice 1 (3) (2020) 1–23.  doi:10.1145/3399668.
  * [135] S. Gupta, B. B. Gupta, P. Chaudhary, Designing a xss defensive framework for web servers deployed in the existing smart city infrastructure, Journal of Organizational and End User Computing 32 (4) (2020) 85–111.  doi:10.4018/JOEUC.2020100105.
  * [136] F. Schuckert, B. Katt, H. Langweg, Difficult xss code patterns for static code analysis tools, in: Proceedings of the ESORICS 2019 International Workshops, IOSec, MSTEC, and FINSEC, ESORICS, Springer, Luxembourg City, Luxembourg, 2020, pp. 123–139.  doi:10.1007/978-3-030-42051-2_9.
  * [137] P. Nagarjun, S. Ahamad, Ensemble methods to detect xss attacks, International Journal of Advanced Computer Science and Applications 11 (5) (2020) 695–700.  doi:10.14569/IJACSA.2020.0110585.
  * [138] G. Xu, X. Xie, S. Huang, J. Zhang, L. Pan, W. Lou, K. Liang, Jscsp: a novel policy-based xss defense mechanism for browsers, IEEE Transactions on Dependable and Secure Computing (2020) 1–17doi:10.1109/TDSC.2020.3009472.
  * [139] Y. Fang, Y. Xu, P. Jia, C. Huang, Providing email privacy by preventing webmail from loading malicious xss payloads, Applied Sciences (Switzerland) 10 (13) (2020) 1–17.  doi:10.3390/app10134425.
  * [140] A. Buyukkayhan, C. Gemicioglu, T. Lauinger, A. Oprea, W. Robertson, E. Kirda, What’s in an exploit? an empirical analysis of reflected server xss exploitation techniques, in: Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses, RAID, USENIX, Donostia/San Sebastian, Spain, 2020, pp. 107–120.
  * [141] X. Li, W. Ma, Z. Zhou, C. Xu, Xss attack detection model based on semi-supervised learning algorithm with weighted neighbor purity, in: Proceedings of the 19th International Conference on Ad-Hoc Networks and Wireless, ADHOC-NOW, Springer, Bari, Italy, 2020, pp. 198–213.  doi:10.1007/978-3-030-61746-2_15.
  * [142] T. Bui, S. Rao, M. Antikainen, T. Aura, Xss vulnerabilities in cloud-application add-ons, in: Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, ASIACCS, ACM, Taipei, Taiwan, 2020, pp. 610–621.  doi:10.1145/3320269.3384744.
  * [143] C. C. C. K. T. Chaudhary Pooja, Gupta B. B., Xsspro: Xss attack detection proxy to defend social networking platforms, in: Proceedings of the 9th International Conference on Computational Data and Social Networks, CSoNet, Springer, Dallas, TX, USA, 2020, pp. 411–422.  doi:10.1007/978-3-030-66046-8_34.
  * [144] N. A. A. Talib, K.-G. Doh, Assessment of dynamic open-source cross-site scripting filters for web application, KSII Transactions on Internet and Information Systems (TIIS) 15 (10) (2021) 3750–3770.  doi:10.3837/tiis.2021.10.015.
  * [145] B. Eriksson, G. Pellegrino, A. Sabelfeld, Black widow: Blackbox data-driven web scanning, in: Proceedings of the 2021 IEEE Symposium on Security and Privacy, SP, IEEE, San Francisco, CA, USA, 2021, pp. 1125–1142.  doi:10.1109/SP40001.2021.00022.
  * [146] B. Garn, D. S. Lang, M. Leithner, D. R. Kuhn, R. Kacker, D. E. Simos, Combinatorially xssing web application firewalls, in: 2021 IEEE International Conference on Software Testing, Verification and Validation Workshops, ICSTW, IEEE, Porto de Galinhas, Brazil, 2021, pp. 85–94.  doi:10.1109/ICSTW52544.2021.00026.
  * [147] V. Malviya, S. Rai, A. Gupta, Development of web browser prototype with embedded classification capability for mitigating cross-site scripting attacks, Applied Soft Computing 102 (2021) 106873.  doi:10.1016/j.asoc.2020.106873.
  * [148] F. Caturano, G. Perrone, S. Romano, Discovering reflected cross-site scripting vulnerabilities using a multiobjective reinforcement learning environment, Computers and Security 103 (2021) 102204.  doi:10.1016/j.cose.2021.102204.
  * [149] P. Chaudhary, B. B. Gupta, X. Chang, N. Nedjah, K. T. Chui, Enhancing big data security through integrating xss scanner into fog nodes for smes gain, Technological Forecasting and Social Change 168 (2021) 120754.  doi:10.1016/j.techfore.2021.120754.
  * [150] Y. Frempong, Y. Snyder, E. Al-Hossami, M. Sridhar, S. Shaikh, Hijax: Human intent javascript xss generator, in: Proceedings of the 18th International Conference on Security and Cryptography, SECRYPT, SciTePress, Milano, Italy, 2021, pp. 798–805.  doi:10.5220/0010583807980805.
  * [151] M. Leithner, B. Garn, D. E. Simos, Hydra: Feedback-driven black-box exploitation of injection vulnerabilities, Information and Software Technology 140 (2021) 106703.  doi:10.1016/j.infsof.2021.106703.
  * [152] P. Wang, J. Bangert, C. Kern, If it’s not secure, it should not compile: Preventing dom-based xss in large-scale web development with api hardening, in: Proceedings of the IEEE/ACM 43rd International Conference on Software Engineering (ICSE), ICSE, IEEE, Madrid, Spain, 2021, pp. 1360–1372.  doi:10.1109/ICSE43902.2021.00123.
  * [153] I. Tariq, M. Sindhu, R. Abbasi, A. Khattak, O. Maqbool, G. Siddiqui, Resolving cross-site scripting attacks through genetic algorithm and reinforcement learning, Expert Systems with Applications 168 (2021) 114386.  doi:10.1016/j.eswa.2020.114386.
  * [154] F. Mereani, J. Howe, Rule extraction from neural networks and other classifiers applied to xss detection, in: Proceedings of the International Joint Conference on Computational Intelligence, IJCCI, Springer, Vienna, Austria, 2021, pp. 359–386.  doi:10.1007/978-3-030-70594-7_15.
  * [155] H. Maurel, S. Vidal, T. Rezk, Statically identifying xss using deep learning, in: Proceedings of the 18th International Conference on Security and Cryptography, SECRYPT, SciTePress, Milano, Italy, 2021, pp. 1–12.  doi:10.5220/0010537000002998.
  * [156] S. Bensalim, D. Klein, T. Barber, M. Johns, Talking about my generation: Targeted dom-based xss exploit generation using dynamic data flow analysis, in: Proceedings of the 14th European Workshop on Systems, EuroSec, ACM, Edinburgh, Scotland, UK, 2021, pp. 27–33.  doi:10.1145/3447852.3458718.
  * [157] W. Melicher, C. Fung, L. Bauer, L. Jia, Towards a lightweight, hybrid approach for detecting dom xss vulnerabilities with machine learning, in: Proceedings of the World Wide Web Conference, WWW, ACM, Ljubljana, Slovenia, 2021, pp. 2684–2695.  doi:10.1145/3442381.3450062.
  * [158] F. Mokbal, W. Dan, W. Xiaoxi, Z. Wenbin, F. Lihua, Xgbxss: An extreme gradient boosting detection framework for cross-site scripting attacks based on hybrid feature selection approach and parameters optimization, Journal of Information Security and Applications 58 (2021) 102813.  doi:10.1016/j.jisa.2021.102813.
  * [159] J. Pazos, J.-S. Légaré, I. Beschastnikh, Xsnare: Application-specific client-side cross-site scripting protection, in: Proceedings of the 2021 IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER, IEEE, Honolulu, HI, USA, 2021, pp. 154–165.  doi:10.1109/SANER50967.2021.00023.
  * [160] Q. Wang, H. Yang, G. Wu, K.-K. R. Choo, Z. Zhang, G. Miao, Y. Ren, Black-box adversarial attacks on xss attack detection model, Computers and Security 113 (2022) 102554.  doi:10.1016/j.cose.2021.102554.
  * [161] F. M. M. Mokbal, D. Wang, X. Wang, Detect cross-site scripting attacks using average word embedding and support vector machine, International Journal of Network Security 4 (1) (2022) 20–28.  doi:10.6633/IJNS.20220124(1).03.
  * [162] Z. Liu, Y. Fang, C. Huang, J. Han, Graphxss: An efficient xss payload detection approach based on graph convolutional network, Computers and Security (2022) 102597doi:10.1016/j.cose.2021.102597.
  * [163] OWASP, Types of cross-site scripting.
URL https://owasp.org/www-community/Types_of_Cross-
Site_Scripting#Types_of_Cross-Site_Scripting)

  * [164] A. Klein, Dom based cross site scripting or xss of the third kind: A look at an overlooked flavor of xss.
URL http://www.webappsec.org/projects/articles/071105.html

  * [165] D. Wagner, P. Soto, Mimicry attacks on host-based intrusion detection systems, in: Proceedings of the 9th ACM Conference on Computer and Communications Security, CCS, ACM, Washington, DC, USA, 2002, pp. 255—264.  doi:10.1145/586110.586145.
  * [166] M. Martin, B. Livshits, M. S. Lam, Finding application errors and security flaws using pql: A program query language, in: Proceedings of the 20th Annual ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications, OOPSLA, ACM, San Diego, CA, USA, 2005, pp. 365—383.  doi:10.1145/1094811.1094840.
  * [167] D. Gusfield, Algorithms on Strings, Trees, and Sequences: Computer Science and Computational Biology, Cambridge University Press, USA, 1997.
  * [168] R. Huang, W. Sun, Y. Xu, H. Chen, D. Towey, X. Xia, A survey on adaptive random testing, IEEE Transactions on Software Engineering 47 (10) (2021) 2052–2083.  doi:10.1109/TSE.2019.2942921.
  * [169] D. R. Kuhn, R. N. Kacker, Y. Lei, Introduction to Combinatorial Testing, 1st Edition, Chapman & Hall/CRC, 2013.  doi:10.5555/2500930.
  * [170] J. C. King, Symbolic execution and program testing, Communication of the ACM 19 (7) (1976) 385–394.  doi:10.1145/360248.360252.
  * [171] C. J. C. H. Watkins, P. Dayan, Q-learning, Machine Learning 8 (3) (1992) 279–292.  doi:10.1007/BF00992698.
  * [172] S. Artzi, A. Kiezun, J. Dolby, F. Tip, D. Dig, A. Paradkar, M. D. Ernst, Finding bugs in dynamic web applications, in: Proceedings of the 2008 International Symposium on Software Testing and Analysis, ISSTA, ACM, Seattle, WA, USA, 2008, pp. 261—272.  doi:10.1145/1390630.1390662.
  * [173] K. DeVoe, Innovations affecting us – what’s greasemonkey, and do i want it in the library?, Against the Grain 20 (3) (2008) 12–12.  doi:10.7771/2380-176X.2425.
  * [174] B. Potteiger, Z. Zhang, L. Cheng, X. Koutsoukos, A tutorial on moving target defense approaches within automotive cyber-physical systems, Frontiers in Future Transportation 2 (2022) 1–13.  doi:10.3389/ffutr.2021.792573.
  * [175] A. W. Marashdih, Z. F. Zaaba, K. Suwais, N. A. Mohd, Web application security: An investigation on static analysis with other algorithms to detect cross site scripting, Procedia Computer Science 161 (2019) 1173–1181.  doi:10.1016/j.procs.2019.11.230.
  * [176] A. Hannousse, S. Yahiouche, Handling webshell attacks: A systematic mapping and survey, Computers & Security 108 (2021) 102366.  doi:10.1016/j.cose.2021.102366.
  * [177] A. Hannousse, S. Yahiouche, Towards benchmark datasets for machine learning based website phishing detection: An experimental study, Engineering Applications of Artificial Intelligence 104 (2021) 104347.  doi:10.1016/j.engappai.2021.104347.
  * [178] B. Mihaljević, C. Bielza, P. Larrañaga, Bayesian networks for interpretable machine learning and optimization, Neurocomputing 456 (2021) 648–665.  doi:10.1016/j.neucom.2021.01.138.
  * [179] A. Ampatzoglou, S. Bibi, P. Avgeriou, M. Verbeek, A. Chatzigeorgiou, Identifying, categorizing and mitigating threats to validity in software engineering secondary studies, Information and Software Technology 106 (2019) 201–230.  doi:10.1016/j.infsof.2018.10.006.
  * [180] Y. Zheng, Z. Li, X. Xu, Q. Zhao, Dynamic defenses in cyber security: Techniques, methods and challenges, Digital Communications and Networks In press.  doi:10.1016/j.dcan.2021.07.006.