Study. uk . com
  1. Home
  2. All questions
  3. Question 152

CompTIA Security+ study material · question 152 of 611

An application built on a modern framework has a stored cross-site scripting flaw. What is the most likely cause?

  1. The framework does not encode output by default
  2. The framework's default encoding was deliberately bypassed to render raw HTML
  3. The database stored the value in the wrong character set
  4. The Content Security Policy was too strict
Show the answer

Answer: B. The framework's default encoding was deliberately bypassed to render raw HTML

Frameworks encode by default, so most such flaws come from an explicit opt-out for rich content.

Source: OWASP Cross Site Scripting Prevention Cheat Sheet (OWASP) — OWASP Cross Site Scripting Prevention Cheat Sheet › Framework Security

Challenge yourself on this topic → Study as cards