Finding and Fixing DOM-based XSS - with Static Analysis

on YouTube ↗29m

" summary

Static analysis via an eslint rule flags DOM sinks (assignments to innerHTML/outerHTML, insertAdjacentHTML, document.write) and treats sanitizer calls and literals as safe; adoption in a large codebase drops thousands of findings to 34 lint violations and surfaces a handful of real DOM‑based XSS bugs that get fixed. A Sanitizer API prototype and gradual CI/linter rollout integrate with TypeScript and Electron workstreams and proves practical and actionable.

AI-written summary · about

" chapters (6)

1. 0:00Intro
2. 7:14Static vs Dynamic Analysis
3. 9:51Static Analysis with eslint
4. 14:55How to avoid false positives
5. 18:05Evaluation
6. 22:25Sanitizer API

" related talks

• 40mClient-Side Protection Against DOM-Base...Sebastian Lekies, Martin Johns, Ben Stock · OWASP AppSec Research (AppSecEU) 2015
• 01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)Sebastian Lekies, Martin Johns, Ben Stock · Black Hat Asia 2015
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 42mDon't trust the DOM: Bypassing XSS mitigations via script gadgetsS. Lekies · OWASP BeNeLux Day 2017
• 57mThe Last XSS Defense TalkJim Manico · NDC Porto 2022
• 42mEverything you need to know about client-side malicious code executionLavakumar Kuppan · JSFoo 2018
• 41mNew Methods in Automated XSS DetectionKen Belva · AppSecUSA 2015
• 32mWriting Secure JavaScript CodeGuy Podjarny · View Source 2017