Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials
summary
Examines how HTML sanitizers fail because they rely on imperfect HTML parsers and browser-specific parsing quirks. Presents MutaGen, a framework that generates HTML fragments exploiting parsing differentials, and reports testing 11 server-side sanitizers—finding most have deficient parsers and that MutaGen automatically bypassed all but two.
AI-written summary · about
related talks
27mSanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail
36mHand Sanitizers in the Wild: A Large-Scale Study of Custom JavaScript...
57mThe Last XSS Defense Talk
01h 02mRevisiting XSS Sanitization
29mFinding and Fixing DOM-based XSS - with Static Analysis
29mRails::HTML5: the strange and remarkable three-year journey
35mEverything You Wanted to Know About DOM Clobbering (But Were...
51mAn Abusive Relationship with AngularJS