The Last XSS Defense Talk
summary
Explains why output-side defenses beat input filtering at scale and gives concrete fixes: use context-aware encoding for HTML/attribute/JS/url, apply DOMPurify or server-side Java/.NET sanitizers for WYSIWYG HTML, reject javascript: URLs in hrefs, and enforce nonce-based CSP or strict-dynamic patterns for scripts. Demonstrates rescuing large jQuery codebases by sanitizing thousands of sites, shows how Trusted Types blocks unsafe DOM APIs, and recommends iframe sandboxing for untrusted third-party widgets.
AI-written summary · about
chapters (14)
- 0:00Start
- 1:59Bonus
- 2:29What Is Xss
- 4:53How Do We Test for Cross-Site Scripting
- 9:29Keystroke Logger
- 16:27Ensure all Protection from Xss Is Done at the Ui Layer
- 26:41Be Careful of Angular Bypass Security Functions
- 28:11Html Rendering
- 32:07Javascript Functions
- 33:20Why Is Inner Html So Dangerous
- 35:19Jquery
- 42:30Iframe Sandbox
- 43:57Content Security Policy
- 55:47Csp Hashes
related talks
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
47mXSS is dead. We just don't get it.
43mNo Excuses Anymore: The Demise of Cross Site Scripting
52mDemystifying Front-End Security
24mWe're struggling to keep up
01h 02mRevisiting XSS Sanitization
37mFront-end Security
23mJavaScript attack surface