I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following :
- It escapes
<
,>
,"
to their HTML entities, but not&
,)
or(
. - You are not in a tag, so you have to create your own.
It's not the first time that I see implementations of this sort. Express.js has this by default for example. Are implementations like these safe from XSS?