A key goal of this approach is to
drastically reduce the fraction of code
that could potentially give rise to
XSS bugs. In particular, with this approach,
an application is structured
such that most of its code cannot be
responsible for XSS bugs. The potential
for vulnerabilities is therefore
confined to infrastructure code such
as Web application frameworks and
HTML templating engines, as well
as small, self-contained applicationspecific
utility modules.