XSS Web Injection - Script Tag with JavaScript Alert Payload - ATR-2026-00475 (a79e52ec-677c-57cf-abbe-cfa99af0d9f0)
Detects XSS injection attempts using script tags with JavaScript alert payloads, including byte-encoded prefix variants used to bypass naive filters. This rule covers the structural pattern of script-tag injection with encoded whitespace or protocol prefix bytes (\xe1\xa0\x8e, \xe2\x80\x82, \xe2\x80\x86, \x3b) preceding a javascript: protocol or alert() call. These are commonly used in garak web_injection probe corpus to test LLM content-filter bypasses. Generalized to catch bare script-alert, encoded-prefix variants, and javascript-protocol variants without requiring exact byte-sequence literals.