Service Worker Web APIs WebRTC Indexed DB Push API Vue.js Frontend React Angular.js Polymer jQuery Package Manager Laravel k8s Docker API Design CSP Suborigins Clear-Site- Data Referrer Policy Mixed Content Security Standards Backend Notificat ion API
<br/>var app = new Vue({<br/>el: '#app',<br/>data: {<br/>message: 'You loaded this page on ' + new Date().toLocaleString()<br/>}<br/>})<br/> ‣ Declarative Rendering works without writing $(...) nor document.getElementId() :-) ‣ If you'd like to modify innerHTML directly, v-html works.
Now you see me <br/>var app3 = new Vue({<br/>el: '#app-3',<br/>data: {<br/>seen: true<br/>}<br/>})<br/> ‣ Vue.js gives you the power of v-* directives ! ‣ v-for, v-on, v-bind, ...
‣ Just only some tags such as and some<br/>attributes such as src should be suspicious?<br/>‣ The answer is NO.<br/>‣ Even a <div> can be a XSS payload :-(<br/>
<br/>var app3 = new Vue({<br/>el: '#app-3',<br/>data: {<br/>seen: true<br/>}<br/>})<br/> Now you see me ‣ Additional attributes or properties introduced by libraries supply more sources for DOM-Based XSS. ‣ e.g. v-* of Vue.js might be a source of eval or innerHTML.
‣ Directives (e.g. v-on, v-show, v-if, v-for, v-bind, ...) evaluate the given value :-( ‣ Vue markup in the HTML is a Vue template; it should be kept in mind that they might be eval()-ed. ‣ Content Security Policy without unsafe-eval will prohibit the use of such templates, but it needs us to use the render function or pre-compile templates into it.
React.createElement("span", props); ‣ You should care about props injection. ‣ dangerouslySetInnerHTML controls innerHTML of the tag. { "dangerouslySetInnerHTML":{ "__html":"" } }
‣ Classical XSS is often overlooked :-( javascript:alert(1)
red;background:red; ‣ The following works with ReactDOMServer. ‣ react-dom/server often causes problem like: https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html#detailed-description
HTTP/1.1 302 FOUND Location: https://origin2.example/ ... https://origin1.example https://tester.example HTTP/1.1 302 FOUND Location: https://b.example.com/test ... https://origin2.example A violation occurs when loading :-( A report will be sent. => tester.example can detect a Cross-origin redirection :-)
lmt_swallow
ikuyamada
puhitaku
kazeburo
jacopen
sbtechnight
tsubakimoto_s
sat
takakuni
tomzoh
se_o_chan
aki_iinuma
paigeccino
dougneiner
skipperchong
jasonvnalue
3n
speakerdeck
addyosmani
yeseniaperezcruz
jonrohan
rasmusluckow
rmw