4 ms·
Am I reading this correctly.. creating a regexp introduced into a template, then applying that template to a value in the web request?
by zer0faith 7y ago
Am I reading this correctly.. creating a regexp introduced into a template, then applying that template to a value in the web request?
- stevekemp 7y agoPretty much. Interestingly it is a very similar approach to Perl's "taint mode". The intention is obviously that you can't blindly use/output values that are user-provided. Instead you must validate, and convert them to a "trusted type", at which point you can use them in your DOM tree, or wherever you wish. The big difference is that if you forget a place here you'll get a type error - rather than the current situation where if you forget to validate/sanitize you get an XSS attack.
- rictic 7y agoTrusted Types just gives you the APIs for declaring what code is allowed to make strings that may be used with unsafe sinks. You could do this by validating inputs with regexes, or you could make a safe-by-construction API, or you could not declare certain methods on your policies and thereby ban entire classes of unsafe API from your page. The key idea is to have a small number of places that declare policies and generate trusted values. You can then audit just those places, because you know that all writes to unsafe DOM sinks must pass through those policies.