as output to the target browser. Note that the activation point is not reached until the
attacker's script is executed within the user's web browser. This demonstrates how
artifact labels can cross multiple components.
Note that a more complicated attack may exist. Using path traversal, the attacker might