The Sanitizer API landed in Firefox 148, along with element.setHTML().
Uncategorized
3
Posts
2
Posters
0
Views
-
The Sanitizer API landed in Firefox 148, along with element.setHTML().
This lets you fully configure how HTML strings are cleaned as they're parsed.
-
R relay@relay.infosec.exchange shared this topic on
-
The Sanitizer API landed in Firefox 148, along with element.setHTML().
This lets you fully configure how HTML strings are cleaned as they're parsed.
@firefoxwebdevs couldn't the attacker change the sanitizer rules to permit the tags they want to exploit?
-
@firefoxwebdevs couldn't the attacker change the sanitizer rules to permit the tags they want to exploit?
@barefootstache if the attacker has enough script access to do that, you've already lost.
Whereas HTML strings often come from things like a database or API.
