# XSS Prevention (ZERO TRUST — MANDATORY)
Zero tolerance for unescaped attacker-controllable strings in HTML. Extensions are especially exposed — content scripts read from arbitrary pages, popups render tab titles / URLs / favicon URLs, and all of those are attacker-controllable. Any string from outside the codebase (tab data, page DOM content, Firestore, API responses, URL params, user input) MUST be escaped before being inserted via `innerHTML`, `insertAdjacentHTML`, `outerHTML`, or attribute interpolation.
## The Rule
**Canonical form (same as UJM/EM):** `webManager.utilities().escapeHTML(value)` inline at every usage site.
```javascript
// ✅ CORRECT — canonical inline form
import webManager from 'web-manager';
$el.innerHTML = `${webManager.utilities().escapeHTML(tab.title)}
`;
$el.innerHTML = `.escapeHTML(tab.favIconUrl)})
`;
// ❌ DANGEROUS — attacker-controlled favicon URL can break out of src=""
$el.innerHTML = `
`;
// Malicious site serves: favIconUrl = 'x" onerror="alert(1)'
// Resulting HTML: 
→ executes in extension page context
// ❌ DANGEROUS — tab title can contain HTML
$el.innerHTML = `${tab.title}
`;
```
**Common extension XSS vectors:**
- `tab.title`, `tab.url`, `tab.favIconUrl` from `chrome.tabs.query/get` — any visited page can set these.
- DOM content read by content scripts and sent back to privileged pages (popup/options/sidepanel).
- Bookmark titles, history entries, recently-closed tabs — all originate from arbitrary pages.
- Stored user data (snippets, saved workspaces) if a malicious page can influence what gets stored.
## NEVER Write Your Own Escape Function
Do NOT:
- Alias: `const escape = webManager.utilities().escapeHTML;`
- Wrap: `const escape = (s) => webManager.utilities().escapeHTML(s);`
- Destructure: `const { escapeHTML } = webManager.utilities();`
- `.bind()` it
- Define a local `escapeHtml`/`escapeHTML` helper in a `utils.js` and import it across files — this is the most common violation in BXM extensions. Delete the helper, add `import webManager from 'web-manager'`, inline the canonical form at every call site.
## URLs Must Also Be Sanitized
`escapeHTML` alone lets `javascript:alert(1)` through — dynamic URLs in executable sinks MUST also be wrapped in `webManager.utilities().sanitizeURL(url)`, which returns `''` for any non-`http:`/`https:` protocol (blocks `javascript:`, `data:`, `vbscript:`). Extensions often build UI from `tab.url` — a malicious page can set a `javascript:` URL that executes when clicked in the popup.
**Must sanitize (can execute JS):**
- ``, ``, ``
- `