Google checks rise of DOM XSS with Trusted Types

guest · Jul 14, 2021

Google checks rise of DOM XSS with Trusted Types
Internal deployment has nullified elusive, complex threat since 2019
July 9, 2021
https://portswigger.net/daily-swig/google-checks-rise-of-dom-xss-with-trusted-types

Google has revealed how a set of internally developed browser APIs and policies can simplify the prevention of DOM-based cross-site scripting (XSS) vulnerabilities.

According to a report penned by Google infosec engineer Krzysztof Kotowicz, the tech giant has been using ‘Trusted Types’ since 2019 and observed “zero DOM XSS in Google applications migrated" to them.
This suggests Trusted Types can become a powerful tool in addressing one of the thorniest security issues affecting web applications.
Click to expand...

With web applications increasingly dependent on client-side code, the complexity and threat posed by DOM XSS vulnerabilities are growing.

“There's a lot of client-side dynamic DOM manipulation in modern web applications, and since multiple Web APIs can cause DOM XSS, the consequences are dire,” Kotowicz told The Daily Swig. “DOM XSS is on the rise. In our applications, we're now seeing 50-60% percent of XSSes introduced in client-side JS.”
Trusted Types – ‘A whole lot easier’
Trusted Types provide HTML header directives and policies that warn or prevent the use of unsafe DOM manipulation code. It also provides a set of JavaScript functions and types to sanitize dynamic DOM content.
Click to expand...

Meanwhile, Bentkowski warns that Trusted Types are not a silver bullet that will eradicate all DOM XSS vulnerabilities. “

However, Trusted Types is still a work in progress and there remain several unresolved problems. In a thread on GitHub, for instance, engineers at Mozilla have expressed concern that the “inherent complexity” of Trusted Types will make it “difficult to adopt by the long tail of websites”.
Click to expand...

Log in or Sign up

Google checks rise of DOM XSS with Trusted Types

guest Guest

Log in or Sign up

Google checks rise of DOM XSS with Trusted Types

guest Guest

Useful Searches