Safe Comment Box
Make a comment box safe to display, without breaking the comments people actually write.
This challenge builds on the XSS Prevention lab. You can start right away, or open the lab first.
Open the XSS Prevention labNot started
An unfinished attempt isn't saved. Reloading the page starts it again; only completion is remembered, and only on this device.
Scenario
Papertrail's comment box
Papertrail lets visitors leave a comment and set a display name. Both are put into the page by gluing the typed text into HTML. A stranger can type markup instead of words, and the browser can't tell it from Papertrail's own.
Fix both places, the comment text and the display-name field, so that no test input can run code while ordinary comments still appear exactly as typed.
Your objectives
- Treat everything a visitor types as untrusted data.
- Render text as text instead of letting the browser parse it as markup.
- Encode output for the context it lands in: element content and quoted attributes need different care.
- Prefer encoding to filtering: filters miss cases and damage real comments.
- Use a Content Security Policy as an extra layer, never as the fix.
Everything here is fictional and runs in your browser. No real accounts, secrets or network requests are involved.