Let's assume we want to write a function that checks input parameters for a potential XSS attack (code is written in Python, but you get the idea):
def is_potential_xss(s):
assert type(s) is str
if not "<" in s:
# pre-check: it cannot be a HTML fragment
return False
# ...
# do a sophisticated, but slow, parsing of the string to detect
# malicious tags or attributes.
...
So here's my question:
Can I safely assume that any html tag must contain a literal "<", e.g.
<script> or are there other representations that a browser would
interpret and execute?
For example <script> would not be executed afaik.
Edit: As @tobias-k noted, XSS would be possible with strings that don't contain <, when inserted in a special context like a tag attribute. However this question is about html fragments that are rendered as html node.