I understand CSP can be beneficial against multiple attack vectors (i.e clickjacking, XSS), but as it specifically relates to XSS -- why is it a solution?
My reason for asking this question stems from a question that i was recently asked. "If input sanitization / output encoding always works, then why has XSS still a thing?"
My initial thoughts were: Because it's not always that simple. XSS can come in multiple contexts, in different forms, etc and CSP (if done correctly) can be an easy way to prevent this. I have primarily always viewed it as a defense in depth measure that should never be used as the sole mechanism against XSS.
With that being said, are there any cases where sanitize input / encode output isn't sufficient against XSS?
<script src>
attribute for example instead of just inlined where a document fragment is expected. Are you willing to assume that each value derived from an untrusted input is correctly sanitized / encoded for all the output contexts it reaches?