insane in the iframe -- the case for client-side html sanitization

David RossPrincipal Software Security EngineerTrustworthy Computing SecurityMicrosoft

@randomdross

https://twitter.com/randomdross

*

http://www.phreedom.org/presentations/blackbox-reversing-of-xss-filters/blackbox-reversing-of-xss-filters.pdf

@NealPoolehttps://t.co/5omk5ec2UD

http://twitter.com/nealpoole

https://t.co/5omk5ec2UD

@kkotowicz@NealPoole @adam_baldwin

http://twitter.com/kkotowicz

http://twitter.com/nealpoole

http://twitter.com/adam_baldwin

@sneak_@superevr

http://twitter.com/sneak_

http://twitter.com/superevr

difficult

• No independent parsing / context handling

everything else

http://lcamtuf.coredump.cx/postxss/

http://www.nds.rub.de/research/publications/scriptless-attacks/

document.implementation.createHTMLDocument

http://msdn.microsoft.com/en-us/library/ie/ff975457(v=vs.85).aspx

document.createTreeWalker

3. Remove elements / attributes / etc. not explicitly allowed*

* Old (less-performant) approach:Build yet another DOM by copying safe elements / attributes / etc. to a new DOM during tree walk

document.implementation.createHTMLDocument

Must never run script

https://developer.mozilla.org/en-US/docs/Code_snippets/HTML_to_DOM

setAttribute

http://msdn.microsoft.com/en-us/library/system.windows.forms.htmlelement.setattribute.aspx

promises / deferreds

http://msdn.microsoft.com/en-us/magazine/gg723713.aspx

[Demo] [Benchmark]

Options precedence / inheritance rules: (Options specified on target element) > (options specified on sanitize() call) > (default options)

http://localhost/dross/jSanity/jsanity-demo-pretty.htm

http://localhost/dross/jSanity/jsanity-benchmark-pretty.htm

Mario Heiderich @0x6D6172696FJSAgents / IceShield

Gareth Heyes @garethheyesJSLR

Ben LivshitsLoris D’Antoni

FAST

Caja HTML sanitizer

Stefano Di Paola Eduardo ‘Sirdarckcat’ Vela N.

http://mario.heideri.ch/

https://twitter.com/0x6D6172696F

http://www.nds.rub.de/research/publications/iceshield-detection-and-mitigation-malicious-sites/

https://hackvertor.co.uk/public

https://twitter.com/garethheyes

http://www.thespanner.co.uk/2012/06/05/jslr/

http://research.microsoft.com/en-us/um/people/livshits/

http://www.cis.upenn.edu/~lorisdan/

http://research.microsoft.com/apps/pubs/default.aspx?id=179252

https://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/plugin/html-sanitizer.js

http://www.wisec.it/sectou.php?id=46c5843ea4900

http://sebug.net/paper/pst_WebZine/pst_WebZine_0x04/ACS - Active Content Signatures.pdf

I just presented on HTML sanitization at OWASP AppSec EU 2013. AMA! (self.AMA)

1 Submitted 1 second ago by randomdross

0 comments share

insane in the iframe -- the case for client-side html sanitization

Technology

sanitization services in udaipur

sanitization - agrochem inc

revista insane

iframe slo 2014 dvoslojno

secure data sanitization

iframe post api user guide - bli...

iframe katalog part6 iframe pivot rev7€¦ · iframe pivot...

d - 19 sanitization equipment

sanitization of electronic media

guidelines for media sanitization

simple iframe app

insane ireland

iframe slo 2014 troslojno

salon safe sanitization

robust javascript [50min] · iframe sandbox same-origin...

insane perspective

facebook:: iframe tabs erstellen

insane perspectives

sanitization in udaipur

ctfa cleaning & sanitization guidelines