  The best practice to prevent Cross Site Scripting (XSS) attacks is to apply
encoders to sanitize untrusted data. To balance security and functionality,
encoders should be applied to match the web page context, such as HTML body,
JavaScript, and style sheets. A common programming error is the use of a wrong
encoder to sanitize untrusted data, leaving the application vulnerable. We
present a security unit testing approach to detect XSS vulnerabilities caused
by improper encoding of untrusted data. Unit tests for the XSS vulnerability
are automatically constructed out of each web page and then evaluated by a unit
test execution framework. A grammar-based attack generator is used to
automatically generate test inputs. We evaluate our approach on a large open
source medical records application, demonstrating that we can detect many 0-day
XSS vulnerabilities with very low false positives, and that the grammar-based
attack generator has better test coverage than industry best practices.
