security

name	security
description	JavaScript security best practices and vulnerability prevention.
sasmp_version	1.3.0
bonded_agent	08-javascript-testing-quality
bond_type	PRIMARY_BOND
skill_type	reference
response_format	code_first
max_tokens	1500
parameter_validation	{"required":["topic"],"optional":["vulnerability_type"]}
retry_logic	{"on_ambiguity":"ask_clarification","fallback":"show_xss_prevention"}
observability	{"entry_log":"Security skill activated","exit_log":"Security reference provided"}

JavaScript Security Skill

Quick Reference Card

XSS Prevention

// DANGEROUS - Never do this
element.innerHTML = userInput;

// SAFE - Use textContent
element.textContent = userInput;

// SAFE - Sanitize HTML
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(userInput);

// SAFE - Create elements
const div = document.createElement('div');
div.textContent = userInput;
parent.appendChild(div);

Input Validation

// Server-side validation is required
// Client-side is for UX only

function validateEmail(email) {
  const pattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return pattern.test(email);
}

function sanitizeInput(input) {
  return input
    .trim()
    .replace(/[<>]/g, ''); // Basic, use library for real apps
}

// Use schema validation
import { z } from 'zod';

const UserSchema = z.object({
  : z.().(),
  : z.().().()
});

.(userData);