Securing the DOM from the Bottom Up
summary
Chrome ships a new browser mechanism called Trusted Types that prevents DOM XSS by making sinks reject raw strings and accept only typed values; a polyfill demonstrates innerHTML throws a type error until a policy-created trustedHTML is supplied via window.trustedTypes.createPolicy. Control comes from a CSP token require-trusted-types-for 'script' plus a trusted-types whitelist so only named policies can be registered. Google reports large reductions in XSS when policy code is small and reviewed; React and DOMPurify integration already work.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:19How does DOM XSS happen?
- 4:41DOM XSS is hard to detect
- 8:11We know how to address it!
- 20:57Control over policies
- 26:10Scalable security with Trusted Types
- 30:13Integration examples
- 34:17Easy to detect
related talks
31mSecuring the DOM from the Bottom Up
27mSecuring Angular with Trusted Types
57mTrusted Types: A World Without XSS
34mDOM XSS Protection at Scale
25mSecuring Angular with Trusted Types
59mThe Final Frontier: Security APIs in Modern Browsers
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
19mWeb Platform Security