Client-Side HTML Encoding for the Mitigation of DOM-Based Cross-Site Scripting
DOI:
https://doi.org/10.33003/fjs-2026-1014-4467Keywords:
Polyherbal Formulation, Antidiabetic, Syrup, LD50, GC-MS, Diabetes MellitusAbstract
Cross-Site Scripting (XSS) remains a pervasive threat to web application security, with DOM-based XSS attacks posing particular challenges due to their execution within the client-side environment. This study proposes a client-side defence mechanism based on HTML encoding to mitigate DOM-based XSS vulnerabilities by sanitising user inputs prior to rendering in the Document Object Model (DOM). The mechanism was evaluated in a controlled environment using representative attack scenarios, including script injection, event-based exploitation, and attribute manipulation. Results demonstrated that attack payloads which executed successfully in the unprotected configuration were rendered as inert text in the protected system, indicating effective mitigation of the evaluated DOM-based XSS scenarios. The proposed approach is lightweight, introduces minimal additional computational overhead, and is straightforward to integrate into existing client-side workflows. This study contributes a practical and targeted solution for addressing client-side XSS vulnerabilities and outlines directions for future work, including extending protection to other XSS types, improving compatibility with legacy browsers, and assessing scalability through large-scale performance evaluations.
References
Abikoye, O. C., Abubakar, A., Dokoro, A. H., Akande, O. N., & Kayode, A. A. (2020). A novel technique to prevent SQL injection and cross-site scripting attacks using Knuth-Morris-Pratt string match algorithm. EURASIP Journal on Information Security, 2020(1), 14. https://doi.org/10.1186/s13635-020-00113-y
Dalai, A. K., Ankush, S. D., & Jena, S. K. (2017). XSS attack prevention using DOM-based filter. In S. C. Satapathy, V. Bhateja, K. Raju, & B. Janakiramaiah (Eds.), Data engineering and intelligent computing: Proceedings of IC3T 2016 (pp. 227–234). Springer. https://doi.org/10.1007/978-981-10-3376-6_25
Galán, E., Alcaide, A., Orfila, A., & Blasco, J. (2010). A multi-agent scanner to detect stored-XSS vulnerabilities. In 2010 International Conference for Internet Technology and Secured Transactions (pp. 1–6). IEEE. https://doi.org/10.1109/ICITST.2010.5608846
Gupta, S., & Gupta, B. B. (2017). Detection, avoidance, and attack pattern mechanisms in modern web application vulnerabilities: Present and future challenges. International Journal of Cloud Applications and Computing (IJCAC), 7(1), 1–43. https://doi.org/10.4018/IJCAC.2017010101
Hydara, I., Sultan, A. B. M., Zulzalil, H., & Admodisastro, N. (2015). Current state of research on cross-site scripting (XSS)—A systematic literature review. Information and Software Technology, 58, 170–186. https://doi.org/10.1016/j.infsof.2014.11.001
Maina, Y. B. (2024). A critical evaluation of security approaches for detection and prevention of SQL injection attacks in web-based applications. FUDMA Journal of Sciences, 8(2), 241–246. https://doi.org/10.33003/fjs-2024-0802-2308
OWASP. (2025). OWASP Top 10 - 2025: The ten most critical web application security risks. Retrieved from https://owasp.org/Top10/
Shar, L. K., & Tan, H. B. K. (2012). Automated removal of cross site scripting vulnerabilities in web applications. Information and Software Technology, 54(5), 467–478. https://doi.org/10.1016/j.infsof.2011.11.006
Shar, L. K., Briand, L. C., & Tan, H. B. K. (2015). Web application vulnerability prediction using hybrid program analysis and machine learning. IEEE Transactions on Dependable and Secure Computing, 12(6), 688–707. https://doi.org/10.1109/TDSC.2014.2373377
Stock, B., Lekies, S., Mueller, T., Spiegel, P., & Johns, M. (2014). Precise client-side protection against DOM-based cross-site scripting. In 23rd USENIX Security Symposium (USENIX Security 14) (pp. 655–670). USENIX Association. https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/stock
Weamie, S. J. Y. (2022). Cross-site scripting attacks and defensive techniques: A comprehensive survey. International Journal of Communications, Network and System Sciences, 15(5), 73–94. https://doi.org/10.4236/ijcns.2022.155006
Downloads
Published
Issue
Section
Categories
License
Copyright (c) 2026 Zerah Abba, Fatimah Adamu-Fika, Jude Enenche Ameh, Dauda Sule, Usman Adedayo Adeniyi, Samaila Musa Abdullahi, Maryam Safiyanu Masari
This work is licensed under a Creative Commons Attribution 4.0 International License.
