PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing Firefox's HTML Sanitizer API

portswigger.net | research | #browser-security | #firefox | #xss | #svg | #html-sanitizer | #sanitizer-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes bypassed Firefox's HTML Sanitizer API: SVG 'use' elements importing same-origin absolute URLs still executed JavaScript, even for uploads protected with Content-Disposition: attachment.
Published
Collected

Related coverage

research · portswigger.net
Bypassing DOMPurify again with mutation XSS
A fresh mutation XSS bypass of DOMPurify's patch: crafted comments and encoded tags mutate sanitized markup into executable XSS in Chrome, plus a CDATA variant for Firefox; fixed in DOMPurify 2.1.
High · vulnerability · nebusec.ai
IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT
A JIT miscompilation reaches arbitrary code execution in the Firefox content process and also affects Tor Browser, underscoring the residual risk in heavily audited JavaScript engines.
vulnerability · projectzero.google
[CVE-2016-9079] The Great DOM Fuzz-off of 2017
A Project Zero post on DOM engine fuzzing and CVE-2016-9079, a Firefox SVG handling bug that was abused in attacks against Tor Browser users.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
Concealing payloads in URL credentials
Payloads concealed in URL credentials stay invisible in Chrome and Firefox address bars, persisting through same-origin navigation; document.URL exposes them, enabling DOM XSS and clobbering.
Back