Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
Apparently, MS Teams executed incoming messages as Angular templates directly for the longest time, and each time a vulnerability was discovered the solution was to add a few regexes to the message validator.
XSS is a command injection vulnerability, like SQL injection. The main way you can get one is if you try to avoid using a parser or serializer, and the only way to fix it is to use a parser and serializer. -
@lorentz translation: innerText good, innerHTML bad
-
@kiki not a direct translation. More like “remember kids, eval is always evil”
“httpOnly cookies prevent XSS attacks”… wow.
As if not being able to get your cookies is going to stop me from doing bad things.
When I'm in via XSS, it's over. I'm changing the page content to your sign-in form with “please sign in again” notice, but it sends email/password straight to me. What percentage of users is going to enter their data? What do you think? With password managers prefilling data, and the annoyance being one “enter” hit away, I think a lot of users will fall for that. No one, including you, will be able to tell the difference without devTools.
You can rotate the session token, but good luck rotating the user's password.
Oh, did I tell you I could register a service worker using XSS that will be running in background FOREVER?
But don't listen to me. Don't think. Just use httpOnly and hope for the best. After all, your favorite dev youtuber said they could protect you from XSS.
random