Typical severity: Medium. The adversary bypasses input validation by using doubled characters in order to perform a cross-site scripting attack. Some filters fail to recognize dangerous sequences if they are preceded by repeated characters. For example, by doubling the < before a script command, (
Design: Use libraries and templates that minimize unfiltered input. | Implementation: Normalize, filter and sanitize all user supplied fields. | Implementation: The victim should configure the browser to minimize active content from untrusted sources.