Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add use case for safely transitioning websites to not use any DOM XSS injection sinks #408

Merged
merged 2 commits into from
Jan 22, 2024
Merged

Add use case for safely transitioning websites to not use any DOM XSS injection sinks #408

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5726e11
Add goal for transitioning websites to save states
mbrodesser-Igalia Jan 17, 2024
423cb2e
Remove goal with technical means, extend goal to detect vulnerabiliti…
mbrodesser-Igalia Jan 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion spec/index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ monitor and review.
* Reduce security review surface for complex web application
codebases.

* Allow the detection of vulnerabilities similar to how regular
* Allow the usability-preserving detection of vulnerabilities similar to how regular
programming errors are detected and surfaced to the developers, with the
assist of dynamic and static analysis tools.

Expand Down Expand Up @@ -131,6 +131,18 @@ monitor and review.
XSS vulnerabilities, author defines a Trusted Type policy in the
templating library and enables the enforcement for the [[#dom-xss-injection-sinks]].

* A website uses [[#dom-xss-injection-sinks]]. The website-developer adds trusted
types to it and monitors violations by using the
<a http-header>Content-Security-Policy-Report-Only</a> header field.
Violations are iteratively fixed by refactoring the code to use only safe
methods. Afterwards, no [[#dom-xss-injection-sinks]] are called anymore.
Hence, no trusted types are required anymore. The developer switches the
report-only mode off and disables trusted type policies with the
[=trusted-types-directive|trusted-types=] and the
[=require-trusted-types-for-directive|require-trusted-types-for=]
directives.
The website's functionality was never impaired during the refactorings.

* A large team maintains a complex client-side application.
They create a number of Trusted Types policies that satisfy the security
requirements for the application. The team consolidates the policy
Expand Down
Loading