Insane in the IFRAME -- The case for client-side HTML sanitization

•Transferir como PPTX, PDF•

3 gostaram•4,792 visualizações

Server-side HTML sanitization is a familiar web application building block, yet despite years of offensive security research, defensive “sanitizer science” is still a kind of voodoo magic. This talk will make the case that as server-side HTML sanitizers lack the ability to effectively simulate every potential user agent, the client itself is the only party empowered to perform accurate sanitization. We will examine the DOM API primitives required to perform such client-side sanitization and review results and learning from a prototype implementation.

Tecnologia

David Ross
Principal Software Security Engineer
Trustworthy Computing Security
Microsoft

• No independent parsing / context handling

document.implementation.createHTMLDocument

3. Remove elements / attributes / etc. not explicitly allowed*
*Old (less-performant) approach:
Build yet another DOM by copying safe
elements / attributes / etc. to a new
DOM during tree walk

document.implementation.createHTMLDocument
Must never run script

[Demo] [Benchmark]
Options precedence / inheritance rules:
(Options specified on target
element) > (options specified on
sanitize() call) > (default options)

Mario Heiderich @0x6D6172696F
JSAgents / IceShield
Gareth Heyes @garethheyes
JSLR
Ben Livshits
Loris D’Antoni
FAST
Caja HTML sanitizer
Stefano Di Paola Eduardo ‘Sirdarckcat’Vela N.

I just presented on HTML sanitization at OWASP AppSec EU 2013. AMA! (self.AMA)
1 Submitted 1 second ago by randomdross
0 comments share

Mais conteúdo relacionado

Semelhante a Insane in the IFRAME -- The case for client-side HTML sanitization

The talk was held in Mainz at the JAX on April 21, 2016 The language is german. „Software is eating the world“ und das moderne Web hat sicherlich einen sehr großen Anteil daran. Wie könnte aber die nächste Evolutionsstufe im Web aussehen? Ein Kandidat sind hier die Web Components, die einen sehr einfachen Einstieg in die komponentenbasierte Strukturierung von Webanwendungen bieten. Hierbei können auch einzelne Komponenten in bestehende Anwendungen integriert und nachgerüstet werden, ohne dabei das Entwickler-Know-how im konkreten Framework zu verlieren. In diesem Vortrag wird zunächst ein Überblick über den aktuellen Status quo von Web Components gegeben und anschließend beispielhaft gezeigt, wie sich Komponenten in eine bestehende AngularJS-Anwendung integrieren lassen. Ein Ausblick auf Tooling und kommende Features rundet den Vortrag ab.

Web Components mit Polymer und AngularJS 1.x

PatrickHillert

„Software is eating the world“ und das moderne Web hat sicherlich einen sehr großen Anteil daran. Wie könnte aber die nächste Evolutionsstufe im Web aussehen? Ein Kandidat sind hier die Web Components, die einen sehr einfachen Einstieg in die komponentenbasierte Strukturierung von Webanwendungen bieten. Hierbei können auch einzelne Komponenten in bestehende Anwendungen integriert und nachgerüstet werden, ohne dabei das Entwickler-Know-how im konkreten Framework zu verlieren. In diesem Vortrag wird zunächst ein Überblick über den aktuellen Status quo von Web Components gegeben und anschließend beispielhaft gezeigt, wie sich Komponenten in eine bestehende AngularJS-Anwendung integrieren lassen. Ein Ausblick auf Tooling und kommende Features rundet den Vortrag ab. Event: JAX 2016, 21.04.2016 Speaker: Patrick Hillert, inovex GmbH Mehr Tech-Vorträge: https://www.inovex.de/de/content-pool/vortraege/

Web Components mit Polymer und AngularJS 1.x

inovex GmbH

Selenium for-ops

Łukasz Proszek

Standing on the Shoulders of Giants – The Kotti Web Application Framework

Don Disko

Automated JavaScript Deobfuscation - PacSec 2007

Stephan Chenette

Are you securing your microservice architectures by hiding them behind a firewall? That works, but there are better ways to do it. This presentation recommends 11 patterns to secure microservice architectures. 1. Be Secure by Design 2. Scan Dependencies 3. Use HTTPS Everywhere 4. Use Access and Identity Tokens 5. Encrypt and Protect Secrets 6. Verify Security with Delivery Pipelines 7. Slow Down Attackers 8. Use Docker Rootless Mode 9. Use Time-Based Security 10. Scan Docker and Kubernetes Configuration for Vulnerabilities 11. Know Your Cloud and Cluster Security Blog post: https://developer.okta.com/blog/2020/03/23/microservice-security-patterns

Security Patterns for Microservice Architectures - ADTMag Microservices & API...

Matt Raible

Microsoft Security Development Lifecycle

Razi Rais

Stage 1 Tradecraft

matt806068

Building Social Enterprise with Ruby and Salesforce

Raymond Gao

Client-side JavaScript

Lilia Sfaxi

Programmers building apps that work on every device and platform face many challenges. Despite the advances in browsers, tools and specs designed to meet those challenges, HTML is still an extremely limited language for composing complex apps. Web Components solve that problem by letting programmers extend HTML. This session shows how to use Web Components to build modern complex apps with reusable, responsive, framework-agnostic Web Components that can run (almost) everywhere. We'll talk about all the pieces that make this work, including native templates, Shadow DOM, custom elements, and polyfill libraries like polymer and x-tag.

Web components

Noam Kfir

Android Security - Common Security Pitfalls in Android Applications

BlrDroid

Bridging the Gap

Will Schroeder

This talk will review the advanced security features in DataStax Enterprise and discuss best practices for secure deployments. In particular, topics reviewed will cover: Authentication with Kerberos & LDAP/Active Directory, Role-based Authorization and LDAP role assignment, Auditing, Securing network communication, Encrypting data files and using the Key-Management Interoperability Protocol (KMIP) for secure off-host key management. The talk will also suggest strategies for addressing security needs not met directly by the built-in features of the database such as how to address applications that require Attribute Based Access Control (ABAC). About the Speaker Matt Kennedy Sr. Product Manager, DataStax Matt Kennedy works at DataStax as the product manager for DataStax Enterprise Core. Matt has been a Cassandra user and occasional contributor since version 0.7 and was named a Cassandra MVP in 2013 shortly before joining DataStax. Unlike Cassandra, Matt is not partition tolerant.

DataStax | Best Practices for Securing DataStax Enterprise (Matt Kennedy) | C...

DataStax

XCS110_All_Slides.pdf

ssuser01066a

We all know we have Anonymous, LulzSec, and NSA around. With this in mind, isn't it time to think about the security of our systems? Well, of course. In this talk, we'll show how Domain Driven Design is used to counteract security weaknesses without one thinking "security" all the time. So, if you're interested in learning how to design secure software, then this session is for you. Business and technical attacks are two kinds of attacks, where the latter is most famous, e g SQL Injection & XSS. But it doesn't mean business attacks are less harmful. On the contrary, they tend to be extremely sophisticated and powerful as they often leave infrastructure intact without firing alarms. Domain Driven Security is the field that counteracts both categories by using tools and mindsets from DDD.

Domain Driven Security Jfokus 2016

Omegapoint Academy

Security Patterns for Microservice Architectures - London Java Community 2020

Matt Raible

Microsoft Entity Framework

Mahmoud Tolba

If I have to name a single biggest hype in software architecture land then it would be "microservice". They are supposed to be small and focused, can be deployed independently, can work with any technology and will solve all your monolithical problems. But we all know that silver bullets don't exist, plus technology should never be a goal, but merely a means to an end. Nonetheless, following the path towards real microservices is a great strategy for decomposing a monolith without the deployment complexity of the first. So how do you do that? What technologies does the .NET realm offer for us? In this talk, I'll show you some of the pros and cons of micro-services and its ingredients to leverage modern-day .NET and Event Sourcing to move your monolith into a bright new future.

Decomposing the Monolith using modern-day .NET and a touch of microservices

Dennis Doomen

PowerShell-and-DSC-Enables-DSCDevOps-1.pptx

prabhatthunuguntla

Semelhante a Insane in the IFRAME -- The case for client-side HTML sanitization (20)

Web Components mit Polymer und AngularJS 1.x

Selenium for-ops

Standing on the Shoulders of Giants – The Kotti Web Application Framework

Automated JavaScript Deobfuscation - PacSec 2007

Security Patterns for Microservice Architectures - ADTMag Microservices & API...

Microsoft Security Development Lifecycle

Stage 1 Tradecraft

Building Social Enterprise with Ruby and Salesforce

Client-side JavaScript

Web components

Android Security - Common Security Pitfalls in Android Applications

Bridging the Gap

DataStax | Best Practices for Securing DataStax Enterprise (Matt Kennedy) | C...

XCS110_All_Slides.pdf

Domain Driven Security Jfokus 2016

Security Patterns for Microservice Architectures - London Java Community 2020

Microsoft Entity Framework

Decomposing the Monolith using modern-day .NET and a touch of microservices

PowerShell-and-DSC-Enables-DSCDevOps-1.pptx

Último

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc

As privacy and data protection regulations evolve rapidly, organizations operating in multiple jurisdictions face mounting challenges to ensure compliance and safeguard customer data. With state-specific privacy laws coming up in multiple states this year, it is essential to understand what their unique data protection regulations will require clearly. How will data privacy evolve in the US in 2024? How to stay compliant? Our panellists will guide you through the intricacies of these states' specific data privacy laws, clarifying complex legal frameworks and compliance requirements. This webinar will review: - The essential aspects of each state's privacy landscape and the latest updates - Common compliance challenges faced by organizations operating in multiple states and best practices to achieve regulatory adherence - Valuable insights into potential changes to existing regulations and prepare your organization for the evolving landscape

TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments

TrustArc

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

Automating Google Workspace (GWS) & more with Apps Script

wesley chun

🐬 The future of MySQL is Postgres 🐘

RTylerCroy

With more memory available, system performance of three Dell devices increased, which can translate to a better user experience Conclusion When your system has plenty of RAM to meet your needs, you can efficiently access the applications and data you need to finish projects and to-do lists without sacrificing time and focus. Our test results show that with more memory available, three Dell PCs delivered better performance and took less time to complete the Procyon Office Productivity benchmark. These advantages translate to users being able to complete workflows more quickly and multitask more easily. Whether you need the mobility of the Latitude 5440, the creative capabilities of the Precision 3470, or the high performance of the OptiPlex Tower Plus 7010, configuring your system with more RAM can help keep processes running smoothly, enabling you to do more without compromising performance.

Boost PC performance: How more available memory can improve productivity

Principled Technologies

Tech Trends Report 2024 Future Today Institute.pdf

hans926745

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

Enterprise Knowledge’s Urmi Majumder, Principal Data Architecture Consultant, and Fernando Aguilar Islas, Senior Data Science Consultant, presented "Driving Behavioral Change for Information Management through Data-Driven Green Strategy" on March 27, 2024 at Enterprise Data World (EDW) in Orlando, Florida. In this presentation, Urmi and Fernando discussed a case study describing how the information management division in a large supply chain organization drove user behavior change through awareness of the carbon footprint of their duplicated and near-duplicated content, identified via advanced data analytics. Check out their presentation to gain valuable perspectives on utilizing data-driven strategies to influence positive behavioral shifts and support sustainability initiatives within your organization. In this session, participants gained answers to the following questions: - What is a Green Information Management (IM) Strategy, and why should you have one? - How can Artificial Intelligence (AI) and Machine Learning (ML) support your Green IM Strategy through content deduplication? - How can an organization use insights into their data to influence employee behavior for IM? - How can you reap additional benefits from content reduction that go beyond Green IM?

Driving Behavioral Change for Information Management through Data-Driven Gree...

Enterprise Knowledge

Scaling API-first – The story of a global engineering organization

Radu Cotescu

Finology Group – Insurtech Innovation Award 2024

The Digital Insurer

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...

Neo4j

Histor y of HAM Radio presentation slide

vu2urc

Developing An App To Navigate The Roads of Brazil

V3cube

Axa Assurance Maroc - Insurer Innovation Award 2024

The Digital Insurer

Created by Mozilla Research in 2012 and now part of Linux Foundation Europe, the Servo project is an experimental rendering engine written in Rust. It combines memory safety and concurrency to create an independent, modular, and embeddable rendering engine that adheres to web standards. Stewardship of Servo moved from Mozilla Research to the Linux Foundation in 2020, where its mission remains unchanged. After some slow years, in 2023 there has been renewed activity on the project, with a roadmap now focused on improving the engine’s CSS 2 conformance, exploring Android support, and making Servo a practical embeddable rendering engine. In this presentation, Rakhi Sharma reviews the status of the project, our recent developments in 2023, our collaboration with Tauri to make Servo an easy-to-use embeddable rendering engine, and our plans for the future to make Servo an alternative web rendering engine for the embedded devices industry. (c) Embedded Open Source Summit 2024 April 16-18, 2024 Seattle, Washington (US) https://events.linuxfoundation.org/embedded-open-source-summit/ https://ossna2024.sched.com/event/1aBNF/a-year-of-servo-reboot-where-are-we-now-rakhi-sharma-igalia

A Year of the Servo Reboot: Where Are We Now?

Igalia

[2024]Digital Global Overview Report 2024 Meltwater.pdf

hans926745

What is a good lead in your organisation? Which leads are priority? What happens to leads? When sales and marketing give different answers to these questions, or perhaps aren't sure of the answers at all, frustrations build and opportunities are left on the table. Join us for an illuminating session with Cian McLoughlin, HubSpot Principal Customer Success Manager, as we look at that crucial piece of the customer journey in which leads are transferred from marketing to sales.

04-2024-HHUG-Sales-and-Marketing-Alignment.pptx

HampshireHUG

Insane in the IFRAME -- The case for client-side HTML sanitization

1. David Ross Principal Software Security Engineer Trustworthy Computing Security Microsoft

2. @randomdross

5. *

6. @NealPoole https://t.co/5omk5ec2UD

8. @kkotowicz @NealPoole @adam_baldwin

9. @sneak_ @superevr

10.

11. difficult

12.

13. • No independent parsing / context handling

14. everything else

15. document.implementation.createHTMLDocument

16. document.createTreeWalker

17. 3. Remove elements / attributes / etc. not explicitly allowed* *Old (less-performant) approach: Build yet another DOM by copying safe elements / attributes / etc. to a new DOM during tree walk

18.

19.

20. document.implementation.createHTMLDocument Must never run script

21.

22. setAttribute

23.

24. promises / deferreds

25.

26.

27.

28. [Demo] [Benchmark] Options precedence / inheritance rules: (Options specified on target element) > (options specified on sanitize() call) > (default options)

29.

30.

31.

32. Mario Heiderich @0x6D6172696F JSAgents / IceShield Gareth Heyes @garethheyes JSLR Ben Livshits Loris D’Antoni FAST Caja HTML sanitizer Stefano Di Paola Eduardo ‘Sirdarckcat’Vela N.

33.

34. I just presented on HTML sanitization at OWASP AppSec EU 2013. AMA! (self.AMA) 1 Submitted 1 second ago by randomdross 0 comments share

Insane in the IFRAME -- The case for client-side HTML sanitization

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Insane in the IFRAME -- The case for client-side HTML sanitization

Semelhante a Insane in the IFRAME -- The case for client-side HTML sanitization (20)

Último

Último (20)

Insane in the IFRAME -- The case for client-side HTML sanitization