What is mutation XSS?
Developers can control the kind of tags that will be allowed in the HTML code ahead of the cleaning process. A flaw in the way the function handled some configurations of allowed tags made it vulnerable to “mutation XSS”, a special kind of XSS flaw caused by how different browsers interpret HTML code.
Is DOMPurify secure?
DOMPurify is really fantastic security work. It would make for a brilliant contribution to the DOM. I don’t see that as a valid security concern in this case. Yes, it will break your code or do unintended things.
How is mutation XSS ( mxss ) used in HTML?
This mutation is highly unpredictable since it is not part of the specified innerHTML handling, but is a proprietary optimization of HTML code implemented differently in each of the main browser families. The mutated string now contains a valid XSS vector, and the attack will be executed on rendering the new DOM element.
What causes mutation XSS vulnerability in Closure Library?
The vulnerability in the Closure library was very difficult to detect. It relied on a rarely used technique called mutation XSS. Mutation XSS vulnerabilities are caused by differences in how browsers interpret the HTML standard. Due to browser differences, it is very difficult to sanitize user input on the server.
Are there any security problems with Using XSS in HTML?
The main security problem arising here is that the user might include malicious HTML/JavaScript code and introduce XSS. So the main question that creators of such applications need to ask themselves is: “how can we make sure that HTML provided by the user is safe and won’t expose us to XSS?”. This is where HTML sanitizers/purifies come into play.
Why does XSS work differently in different browsers?
The HTML specification states that the noscript tag must be interpreted differently depending on whether JavaScript is enabled in the browser or not. This difference in browser behavior is exactly what Masato Kinugawa used for his XSS proof-of-concept attack.