PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Enabling Trusted Types in a Complex Web Application: A Case Study of AppSheet

bughunters.google.com | blog | #web-security | #case-study | #dom-xss | #google | #trusted-types | #appsheet | #frontend-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Google case study on rolling out Trusted Types in AppSheet, covering how the team enforced DOM XSS protections in a complex production web application.
Published
Collected

Related coverage

blog · bughunters.google.com
ESCAL8 2026: Agentic Hacking in the Lion City
Check out this post to learn more about ESCAL8 2026, Google’s annual flagship security conference, coming to Singapore from October 23–25, 2026!
blog · bughunters.google.com
Breaking into Google's GFile for $100k
This post details an attack on Google’s internal APIs, bypassing authorization to exploit the GFile library to gain access to internal filesystems and storage.
blog · bughunters.google.com
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · bughunters.google.com
More Cryptanalysis Makes Us All Safer
This post analyzes results published by Anthropic and argues that these recent advances do not signal the downfall of cryptography.
blog · portswigger.net
DOM Invader and the case of direct eval vs indirect eval
Gareth Heyes explains why DOM Invader can trigger eval exceptions: direct eval calls can access local scope variables, while indirect eval via a renamed reference runs in global scope and cannot.
blog · portswigger.net
Finding client-side prototype pollution with DOM Invader
DOM Invader has been upgraded to detect client-side prototype pollution (CSPP) in a couple of clicks. The post explains pollution sources, gadgets, and how the tool finds and exploits them.
Back