Almost all of my XSS false positives come from Burp sending raw byte array payloads to the server and getting the same response injected into DOM or whatever. But in real world browsers automatically URL encode requests (RFC standard), and this is something Burp can't yet handle. Or at least I couldn't find it.
Do you have something for this? I'm talking about the Scanner explicitly.
I would've made an extension that implements
IScannerInsertionPointProvider correctly, but as far as I know there's no way to apply it only for XSS payloads. There are some other vectors where non-urlencoded version is the one I want to use.