New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Defense against Mutation XSS attacks [WIP] #89

Open

vojtech-dobes wants to merge 3 commits into master from mxss

Owner

vojtech-dobes commented May 24, 2014

Fixes #88. Work in progress.

/cc @mishak87: is this correct approach? If this is correct implementation of TrueHTML, then 2 points must be resolved:

TrueHTML cannot be used if Object.defineProperty is not available (or broken in IE8) OR XmlSerializer isn't available
if TrueHTML cannot be used:
- 1. HTML must be sanitized in different way
- 2. nette.ajax.js will refuse to update snippet
- 3. nette.ajax.js will update snippet but scream about security hole

vojtech-dobes added 2 commits

May 24, 2014 15:44


          Mitigation of Mutation XSS attacks [WIP] [fixes #88]

90199b0


          added truehtml source

7ee73ca

vojtech-dobes changed the title ~~Mitigation of Mutation XSS attacks [WIP]~~ Defense against Mutation XSS attacks [WIP]


          simple mxss caching

f393eec

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet