An Interesting Copy-Paste Case - on the Risks of Pasting...
summary
The talk demonstrates that copying formatted content from untrusted web pages and pasting it into sensitive sites can lead to stored or reflected XSS, because clipboard paste transfers HTML. It analyzes browser sanitizers (Blink, Gecko, WebKit, EdgeHTML) and WYSIWYG editor cleaners—showing flaws in their HTML-cleaning logic (including regex/string-based sanitizers) and gives live exploit examples.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:27Copy-paste attack demo
- 7:06Rich text editor vulnerability
- 13:48HTML and JS in clipboard
- 25:14CSS injection risks
- 33:51JS clipboard handling
- 37:06HTML parsers in editors
- 42:46TinyMCE exploit
- 45:17Q&A
related talks
45mCopy Pest - A Case Study On The ClipBoard, Blind Trust And Invis...
41mXSS Horror Show
59mBrowsers Gone Wild
01h 02mRevisiting XSS Sanitization
57mThe Last XSS Defense Talk
34m"The magic of XSS - not only in web applications"
07mWhat is an XSS attack - and why should you care?
47mFrom Theory To Practice: Navigating The Challenges Of Vulnerability Research