Question: DON'T apply any filters inside any scriptable contexts?

[chiefjester]

I'm not sure I follow. Can you elaborate when to use the filter? I assume filter means any method in xssFilters?

1. Is this warning only applies on Client-side?
2. Why is the example right before the warning applying filters inside a scritable context / <script>

<script>
var firstname = "..."; //an untrusted input collected from user
document.write('<h1> Hello, ' + xssFilters.inHTMLData(firstname) + '!</h1>')
</script>

[adon-at-work]

good question. let's take a look at two vuln examples of what we want dev to avoid:

// assume you're using express at server-side
res.send('<a onclick="func(' + xssFilters.inDoubleQuotedAttr(untrusted) + ')">bomb</a>')

// assume on client-side
document.write('<a onclick="func(' + xssFilters.inDoubleQuotedAttr(untrusted) + ')">bomb</a>')

will that help better explain what scriptable context means?

[chiefjester]

thank you for the quick response!