DOM XSS Protection at Scale

on YouTube ↗34m

" summary

Claims that Trusted Types plus a rollout pipeline eliminates DOM XSS at scale, with Google reporting zero DOM XSS across hundreds of apps serving billions of users. Practical tools are CSP with required-trusted-types-for, runtime trusted types policies, a safe-values library and t-c static checks. Built pieces include reporting endpoints, DevTools violation tracing, legacy/reviewed conversions, default-policy fallbacks and occasional forked patches for dependencies; enforcement mode blocks bad assignments and reporting mode lets teams triage before switching to enforcement.

AI-written summary · about

" chapters (9)

1. 0:00Introduction
2. 1:48DOM XSS critical issue
3. 4:16DOM-based XSS vulnerabilities
4. 8:08Trusted Types mitigate DOM XSS
5. 11:41Building Trusted Types apps
6. 15:11Refactoring apps for Trusted Types
7. 21:26Debugging Trusted Types violations
8. 27:48Third-party dependencies in Trusted Types
9. 32:26Key takeaways

" related talks

• 36mSecuring the DOM from the Bottom UpMike Samuel, Krzysztof Kotowicz · Node+JS Interactive 2019
• 57mTrusted Types: A World Without XSSGabor Pék, Dávid Schütz · OWASP 2022 Global AppSec Europe Virtual Event
• 31mSecuring the DOM from the Bottom UpKrzysztof Kotowicz · JSNation 2019
• 16mEliminating XSS Angular applications by adopting TTBjarki Agust Gudmundsson · EnterpriseNG 2021
• 31mAchieving Secure Software through RedesignMike Samuel · Nordic.js 2018
• 27mSecuring Angular with Trusted TypesPhilippe De Ryck · NG-BE 2021
• 01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)Sebastian Lekies, Martin Johns, Ben Stock · Black Hat Asia 2015
• 40mClient-Side Protection Against DOM-Base...Sebastian Lekies, Martin Johns, Ben Stock · OWASP AppSec Research (AppSecEU) 2015