Client-Side Protection Against DOM-Base...
summary
A practical evaluation finds the built-in XSS auditor misses many DOM XSS cases: a taint-tracking crawler and automated exploit generator targets the Alexa top 10k, finds ~1,600 vulnerabilities across 958 domains, and achieves a 72% bypass rate against the auditor by exploiting partial/trailing/multi-injection patterns. A patched taint-aware Chromium prototype enforces taint at the JS-parsing level, eliminates those tests’ false negatives, keeps false positives to ~0.016% of documents, and incurs an evaluative runtime overhead around 8–16%.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 0:34Overview
- 1:06Slides
- 2:45XSS vulnerability
- 3:51XSS Types
- 4:12What is DOMBase
- 5:13How to stop XS attacks
- 6:29Clients XSS
- 7:30Automated expert generator
- 8:22Alexa top 10000 domains
- 8:53Disabling the XSS auditor
- 9:19Testing the XSS auditor
- 10:18Crosssite scripting attack
- 14:09Inline scripts
- 14:57Attributes
- 15:35External Content
- 17:02Preventing the XSS Auditor
- 17:56Performance
- 19:01Avoiding invocation
- 19:48String matching issues
- 20:26Partial injections
- 22:46Trailing content
- 28:45Demo
- 29:41Solution
- 31:44Example
- 33:26False Negatives
- 34:04False Positives
- 35:07Performance Results
- 36:45Conclusion
related talks
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
42mDon't trust the DOM: Bypassing XSS mitigations via script gadgets
41mThe Insecurity Caused By Trusting Your Client-Side Storage
42mEverything you need to know about client-side malicious code execution
23mJavaScript attack surface
31m360° View of XSS
29mFinding and Fixing DOM-based XSS - with Static Analysis