You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “sanitization”

Every note filed under sanitization, newest first.

A filtered view of the notes.

2026

  1. Two Parsers Walk Into a DOM

    Every HTML sanitizer is a second implementation of a parser it does not control. Mutation XSS is what happens in the gap — and it is why the fix eventually had to move inside the browser.

    security web xss sanitization svg browsers parsing dissecting-systems