Google Chrome is ditching its XSS detection tool
nakedsecurity.sophos.com
Google Chrome is ditching its XSS detection tool
1–10 of 28 posts
Re: Google Chrome is ditching its XSS detection tool
#2Scary headline; FTA:
> Don’t worry, though – another, hopefully better, protection measure is on the way.
> Another feature is in development to help: an application programming interface (API) called Trusted Types. Trusted types treats user input as untrustworthy by default and forces developers to take steps to sanitise it before it can be included in a web page.
A better headline may be "Google Chrome replacing XSS Auditor with Trusted Types"
Re: Google Chrome is ditching its XSS detection tool
#3Scary headline; FTA: > Don’t worry, though – another, hopefully better, protection measure is on the way. > Another feature is in development to help: an application programming interface (API) called Trusted Types. Trusted types treats user input as untrustworthy by default and forces developers to take steps to sanitise it before it can be included in a web page. A better headline may be "Google Chrome replacing XS…
Reminds me of Perl's taint mode
Re: Google Chrome is ditching its XSS detection tool
#4Disclaimer: I'm working on the Trusted Types project in Google.
To clarify, Trusted Types are not a replacement for XSS auditor. They are both related to XSS, but are fundamentally different and even target different flavors of XSS.
Trusted Types are an opt-in browser API that helps developers prevent DOM-based (~client-side) XSS by mandating that developer-specified rules are applied to data that reaches risky functions (like eval or innerHTML). We're working on having it available as a proper W3C spec. More info at https://bit.ly/trusted-types or https://youtu.be/1KQngEZ8qH4
XSS auditor was an opt-out Chrome only feature that tried to stop reflected (~server-side) XSS payloads from executing after the injection has already happened. It was an now outdated concept. The idea was nice - prevent XSS without changing a bit of code in your application, but now we know this just doesn't work for xss.
Re: Google Chrome is ditching its XSS detection tool
#5It's interesting to hear, knowing the the lack of XSS Auditor on Firefox for years was a recurrent topic on Bugzilla. Even IE and Safari got similar protections. Curious to see if the XSSs I found over the years will now work on Chrome.
Re: Google Chrome is ditching its XSS detection tool
#6Interesting! I recently found that Googlebot was susceptible to XSS [1], but it was mitigated by the recent updates (they updated Googlebot from Chrome 41 to the most recent version).
I guess a lot will depend on the new Trusted Types API. If it is opt-in then I imagine there will be period whilst it is adopted - what happens during this time?
[1] https://www.tomanthony.co.uk/blog/xss-attacks-googlebot-inde...
Re: Google Chrome is ditching its XSS detection tool
#7From a cursory glance, the replacement (Trusted Types), just seems like a very cumbersome runtime type-safety engine kind of thing, shoehorned into a JS/DOM context.
Is that a correct understanding?
If so... Why use this cumbersome API instead of just relying on existing and well-implemented concepts as already present in Flow or Typescript?
That way you could have Flow or Typescript also compile to whatever form this required to have.
Or am I missing some key bits here?
Re: Google Chrome is ditching its XSS detection tool
#8From a cursory glance, the replacement (Trusted Types), just seems like a very cumbersome runtime type-safety engine kind of thing, shoehorned into a JS/DOM context. Is that a correct understanding? If so... Why use this cumbersome API instead of just relying on existing and well-implemented concepts as already present in Flow or Typescript? That way you could have Flow or Typescript also compile to whatever form thi…
This isn't a programming language type safety mechanism, it's a way to tell the browser to enforce that you can't run code that could potentially be vulnerable to XSS, except in specific places that you designate with policies. This example was illuminating for me: https://developers.google.com/web/updates/2019/02/trusted-ty...
Re: Google Chrome is ditching its XSS detection tool
#9From a cursory glance, the replacement (Trusted Types), just seems like a very cumbersome runtime type-safety engine kind of thing, shoehorned into a JS/DOM context. Is that a correct understanding? If so... Why use this cumbersome API instead of just relying on existing and well-implemented concepts as already present in Flow or Typescript? That way you could have Flow or Typescript also compile to whatever form thi…
As far as I know typescripts add types to JavaScript which will enforce tests for certain classes of programming errors. Trusted types is a custom validator for what is allowed to be assigned to innerHTML and the like. That check is done during runtime. Typescript doesn't prevent untrusted code from being infected, but hopefully your validator will.
Re: Google Chrome is ditching its XSS detection tool
#10Good. Whilst the XSS auditor was able to protect against quite a wide range of payloads for reflected vulns, I think it caused more harm than good. Quite often I'd have to try and argue that an issue was real because the PoC didn't work in Chrome. Often I was able to find a way you could cause the server to modify the payload such that the browser was unable to match up the input and output, and then the payload would execute - but I think the legacy of this feature is that it has caused developers to take rXSS much less seriously.