16 ms·
I am always irrationally(?) scared of using these sanitizers despite their successful history. As soon as new html/js/css syntax/features are introduced, won't
by zawerf 7y ago
I am always irrationally(?) scared of using these sanitizers despite their successful history. As soon as new html/js/css syntax/features are introduced, won't your security model need to be reevaluated? Which seems like a lost cause at the rate new capabilities are introduced to the web. E.g., when CSS Shaders lands, you might be able to execute arbitrary gpu code with just css (hypothetically speaking, I don't actually know how it will work. I am sure it'll be sandboxed pretty well. But the problem remains that there are too many new possibilities to keep up with!).
- megous 7y agoMake it a whitelist. :)
- zawerf 7y agoIt wouldn't help if new features extend the capabilities of existing stuff (which is done all the time). For example the CSS Shader example from before adds new syntax to the existing 'filter' css style, which you might've already whitelisted because it is safe today.
- ShaneCurran 7y agoI guess a nested, parameter-granularity whitelist would work in that case :)
- jorangreef 7y agoYou can do that with DOMPurify using hooks.
- jorangreef 7y agoDOMPurify (as a client-side sanitizer) uses a whitelist. There's also CSP for defense-in-depth. I would be more concerned of using server-side sanitizers due to the impedance mismatch between client/server HTML parsing algorithms.
- dogma1138 7y agoSecurity models are constantly being re-evaluated as new threats and attack vectors emerge. What you said can be generically applied to every security control and which is why security is hard.
- nullandvoid 7y agoIsn't that like saying there's no point in using an anti virus as viruses are always evolving? You're still catching entire classes of existing issues..
- hannob 7y ago> Isn't that like saying there's no point in using an anti virus as viruses are always evolving? You're very close to understanding something. (Though in defense of DOM purifiers they can use a whitelist)
- __s 7y agoBad example. Anti virus software is a scam. Just adds another attack vector when the anti virus software has a bug in their file parsing & makes it that you can be impacted by just downloading a malicious file Windows Defender is sufficient & bundled with Windows
- nullandvoid 7y agoI mean I never said anything about buying one you just assumed that. I also just use windows defender of which part of that is an anti virus..
- zAy0LfpBZLC8mAC 7y agoYou mean, you are catching exploits for vulnerabilities that don't exist anymore, and you pay for that with a gigantic attack surface that can be used to compromise you? Yeah, that sounds about right.