You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “xss”

Every note filed under xss, newest first.

A filtered view of the notes.

2026

  1. Strings Do Not Remember Where They Came From

    Trusted Types does not make XSS impossible — the spec says so itself. It makes unreviewed assignment impossible, which is a smaller claim and a far more useful one.

    security web xss trusted-types csp browsers types dissecting-systems

  2. Two Parsers Walk Into a DOM

    Every HTML sanitizer is a second implementation of a parser it does not control. Mutation XSS is what happens in the gap — and it is why the fix eventually had to move inside the browser.

    security web xss sanitization svg browsers parsing dissecting-systems

  3. Trust No Script

    Why a strict Content Security Policy is one of the hardest headers to deploy — and how to read one with Google's CSP Evaluator.

    security csp web xss browsers gen-ai dissecting-systems