Encoding Obfuscation - Script Tag XSS with Encoded Protocol Prefix - ATR-2026-00488 (92eb341a-b859-5463-b370-0f09db63f342)
Detects XSS-style encoding obfuscation attacks using script tags with byte-encoded protocol prefix bytes before javascript:alert() payloads. This rule focuses on the encoding-obfuscation aspect of the garak 'encoding' probe family: attackers use byte sequences (\xe1\xa0\x8e, \xe2\x80\x82, \xe2\x80\x86, \x3b) as encoded whitespace or protocol prefixes within a script tag to bypass naive content filters while still injecting executable JavaScript. Generalized from literal byte sequences to structural patterns. Note: The XSS payloads tested here are identical to ATR-2026-00475 (web_injection family) — both rules catch the same payload family from different probe contexts.