Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail
summary
Claim: server-side HTML sanitization repeatedly fails because parsing and serialization differ across HTML versions, parsers and browsers, and real-world sanitizers share the same buggy components. Examples: HTML5 comment handling and parse/serialize round‑trips turn harmless server DOMs into active XSS in browsers. Multiple PHP sanitizers become bypassable when they rely on libxml2, several projects fail to patch or misconfigure filters, and the practical mitigation is client-side cleanup with tools like DOMPurify or the upcoming sanitizer API.
AI-written summary · about
chapters (8)
- 0:00Introduction and XSS recap
- 0:57Understanding HTML sanitizers
- 4:27Impact of XSS vulnerabilities
- 5:21Client-side vs server-side
- 9:05The core parsing challenge
- 11:57Parser issues and reality
- 18:58Disclosure and future outlook
- 25:58Closing and recommendations
related talks
24mParse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials
57mThe Last XSS Defense Talk
47mXSS is dead. We just don't get it.
01h 02mRevisiting XSS Sanitization
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
29mFinding and Fixing DOM-based XSS - with Static Analysis
48mSecurity Risk: Single-Page Applications.
50mBuilding Secure React Applications