Trusted Types: End to end injection safety at scale KRZYSZTOF KOTOWICZ MIKE SAMUEL

[@domaincontroller]

02:07 DOM XSS, google single largest security problem right now 02:18 it's very easy for a developer to write an assignment to innerHTML such that the value assigned is controlled by an attacker 02:56 the root cause is that we have these browser's APIs and when an attacker-controlled strings reaches them, bad things happen 03:57 CSP enables trusted types 04:55 with trusted types enabled DOM sinks only accept trusted values 05:02 a DOM sink is any browser API 05:51 sinks, more than 60 TrustedHTML w3c.github.io/webappsec-trusted-types/dist/spec/ 06:30 [...] 11:09 default 12:52 we've been doing this for a while now, server-side, gmail 13:10 bug bounty program, this is highly suggestive 14:03 to recap, if you control the CSP header, whitelists =================================== demo =================================== 16:24 angular. search for videos, soundcloud, migrated to trusted types, how to use actually the trusted type API in a real-world application 1github.com/koto/web 17:34 angular, template rendering engine, trusted URL, has its own HTML sanitizer 19:27 jQuery when loaded, through one of the dependency, namely backbone, default policy