DOMPurify

eloper.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP ² https://github.com/cure53/DOMPurify

r https://github.com/szmarczak/http-timer https://github.com/szmarczak/defer-to-connect https://github.com/szmarczak/cacheable-lookup https://github.com/jaredwray/cacheable https://github.com/biomejs/biome https://github.com/sindresorhus/decompress-response https://github.com/sindresorhus/mimic-response https://github.com/octet-stream/form-data-encoder https://github.com/szmarczak/http2-wrapper https://github.com/szmarczak/resolve-alpn https://github.com/sindresorhus/lowercase-keys https://github.com/sindresorhus/p-cancelable https://github.com/sindresorhus/responselike https://github.com/sindresorhus/type-fest https://github.com/sindresorhus/tagged-tag https://github.com/max-mapper/extract-zip https://github.com/sindresorhus/get-stream https://github.com/Sec-ant/readable-stream https://github.com/sindresorhus/is-stream https://github.com/thejoshwolfe/yauzl https://github.com/brianloveswords/buffer-crc32 https://github.com/andrewrk/node-pend https://github.com/i18next/i18next https://github.com/babel/babel https://github.com/microsoft/TypeScript https://github.com/lezer-parser https://github.com/lucide-icons/lucide https://github.com/mathjax/MathJax https://github.com/mermaid-js/mermaid https://github.com/moment/moment https://github.com/mozilla/pdf.js https://github.com/pixijs/pixijs https://github.com/mapbox/earcut https://github.com/primus/eventemitter3 https://github.com/matt-way/gifuct-js https://github.com/matt-way/jsBinarySchemaParser https://github.com/kaimallea/isMobile https://github.com/browserslist/caniuse-lite https://github.com/jkroso/parse-svg-path https://github.com/avoidwork/tiny-lru https://github.com/PrismJS/prism/ https://github.com/mourner/rbush https://github.com/mourner/quickselect https://github.com/remarkjs/remark https://github.com/hakimel/reveal.js https://github.com/barrysteyn/node-scrypt https://github.com/nodejs/nan https://github.com/mixmark-io/turndown https://github.com/mixmark-io/domino https://github.com/webpack/webpack https://github.com/acornjs/acorn https://github.com/nicolo-ribaudo/acorn-import-phases https://github.com/browserslist/browserslist https://github.com/web-platform-dx/baseline-browser-mapping https://github.com/kilian/electron-to-chromium https://github.com/chicoxyzzy/node-releases https://github.com/browserslist/update-db https://github.com/lukeed/escalade https://github.com/alexeyraspopov/picocolors https://github.com/samccone/chrome-trace-event https://github.com/webpack/enhanced-resolve https://github.com/isaacs/node-graceful-fs https://github.com/webpack/tapable https://github.com/guybedford/es-module-lexer https://github.com/eslint/js https://github.com/browserify/events https://github.com/fitzgen/glob-to-regexp https://github.com/isaacs/node-graceful-fs https://github.com/npm/json-parse-even-better-errors https://github.com/webpack/loader-runner https://github.com/jshttp/mime-types https://github.com/jshttp/mime-db https://github.com/suguru03/neo-async https://github.com/webpack/schema-utils https://github.com/ajv-validator/ajv https://github.com/epoberezkin/fast-deep-equal https://github.com/fastify/fast-uri https://github.com/epoberezkin/json-schema-traverse https://github.com/floatdrop/require-from-string https://github.com/ajv-validator/ajv-formats https://github.com/ajv-validator/ajv-keywords https://github.com/DefinitelyTyped/DefinitelyTyped https://github.com/webpack-contrib/terser-webpack-plugin https://github.com/jridgewell/sourcemaps https://github.com/jestjs/jest https://github.com/yahoo/serialize-javascript https://github.com/browserify/randombytes https://github.com/terser/terser https://github.com/tj/commander.js https://github.com/evanw/node-source-map-support https://github.com/LinusU/buffer-from https://github.com/mozilla/source-map https://github.com/webpack/watchpack https://github.com/webpack/webpack-sources https://github.com/eemeli/yaml

ncoding schemes for example. Many an application has been hacked due to a well-meaning engineer trying to prevent open redirect by only allowing urls with '/' at the front in links, not realising that '//x.com' also takes you out to x.com, or preventing '/' at all, not realising that '@x.com' will take you to x.com, or that '../../..' injection can cause requests to any endpoint on the same domain. 2) Javascript is not your only enemy, and it is not by any means your most fierce. You can use CSS to exfiltrate secret tokens: http://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode... Practically any injection can 'redress' your page so it appears drastically different from a user, which is potentially more powerful than just script injection. You can bypass same origin policy boundaries by coercing the user into making input into an invisible iframe if the stars is aligned. 3) Though this article talks about input validation a lot, it doesn't talk about actually how to do this defensively. You need to construct terse expressions that limit to input data you know can only be safe. Many an application has been hacked by specifiying /#[A-Fa-f]{3,6}|.*/ for hex colour codes. Wherever you can, do not deal with raw DBMS language strings (SQL, Javascript) and string interpolation, that's a huge red flag. Instead use a driver / wrapper that provides injection safety and use prepared statements. 4) Unless you really want to invest time into learning web security and doing CTFs, don't try to write your own filters. For example, the suggestion that escaping "'" to "\'" can be bypassed simply by adding a "\" just before the open quote. "'" -> "\'", but "\'" -> "\\'", closing whatever single-quoted string you're in. 5) Serialization is not secure escaping in some contexts. For example, if your endpoint identifies as text/html, but instead returns JSON, I'm going to send some HTML in the JSON string and send a user to the endpoint directly to get XSS. 6) HTML is not your only enemy. XML documents can exfiltrate secrets through XXE and can be coerced into XSS with XHTML islands. Flash is a terrifying thing because it for the most part ignores Content-Types (see: https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-fla...). Requests that flash applications make are just as injectable as any other. Unfortunately, though this article might cover a fair portion of encoding security, huge issues like effective and secure CSRF protection is not discussed. That's a story for another day. One day there will be a thorough and true guide to security in webapp development, but that is not this day.

urrently bypassable with the right malicious content. I recommend using https://github.com/cure53/DOMPurify for this rather than writing your own. It's tricky to get all the edge cases right, so better to use something that's been reviewed by several people (and in DOMPurify's case also undergone a formal security review). Again, we use this at FastMail as part of our webmail.