Hand Sanitizers in the Wild: A Large-Scale Study of Custom JavaScript...
summary
Built an automated pipeline using a Firefox fork with taint tracking to extract sanitizer functions from the top 20K sites, symbolically model each sanitizer, and compute preimages to generate real bypasses; the crawl yields ~4K affected domains, 705 unique sanitizers across 1.4K domains, and 88 sanitizers deemed insecure by the automated checker (102 domains vulnerable) with many bypasses validated in the wild. Recommends DOMPurify, notes upcoming Sanitizer API and Trusted Types.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:33Cross-site scripting prevalence
- 8:27JavaScript sanitizers study
- 14:46Broken sanitizer examples
- 20:00HTML parsing difficulty
- 26:20Avoiding XSS best practices
- 27:05Safer sanitization features
- 34:28Key takeaways and closing remarks
related talks
42mDon't trust the DOM: Bypassing XSS mitigations via script gadgets
24mParse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials
40mClient-Side Protection Against DOM-Base...
59mBeyond Sanitizers...
23mJavaScript attack surface
59mThe Final Frontier: Security APIs in Modern Browsers
29mFinding and Fixing DOM-based XSS - with Static Analysis
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)