  To exchange complex data structures in distributed systems, documents written
in context-free languages are exchanged among communicating parties. Unparsing
these documents correctly is as important as parsing them correctly because
errors during unparsing result in injection vulnerabilities such as cross-site
scripting (XSS) and SQL injection. Injection attacks are not limited to the web
world. Every program that uses input to produce documents in a context-free
language may be vulnerable to this class of attack. Even for widely used
languages such as HTML and JavaScript, there are few approaches that prevent
injection attacks by context-sensitive encoding, and those approaches are tied
to the language. Therefore, the aim of this paper is to derive
context-sensitive encoder from context-free grammars to provide correct
unparsing of maliciously crafted input data for all context-free languages. The
presented solution integrates encoder definition into context-free grammars and
provides a generator for context-sensitive encoders and decoders that are used
during (un)parsing. This unparsing process results in documents where the input
data does neither influence the structure of the document nor change their
intended semantics. By defining encoding during language definition, developers
who use the language are provided with a clean interface for writing and
reading documents written in that language, without the need to care about
security-relevant encoding.
