Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
1–10 of 172 posts
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#2This kind of thing always makes me nervous, because you end with a mix of methods where you can (supposedly) pass arbitrary user input to them and they'll safely handle it, and methods where you can't do that without introducing vulnerabilities - but it's not at all clear which is which from the names. Ideally you design that in from the state, so any dangerous functions are very clearly dangerous from the name. But you can't easily do that down the line.
I'm also rather sceptical of things that "sanitise" HTML, both because there's a long history of them having holes, and because it's not immediately clear what that means, and what exactly is considered "safe".
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#3Great to see this start to show up, but it looks like it will be a while before browser support is widely distributed enough to rely on it being present: https://caniuse.com/mdn-api_element_sethtml
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#4This kind of thing always makes me nervous, because you end with a mix of methods where you can (supposedly) pass arbitrary user input to them and they'll safely handle it, and methods where you can't do that without introducing vulnerabilities - but it's not at all clear which is which from the names. Ideally you design that in from the state, so any dangerous functions are very clearly dangerous from the name. But…
The idea is you wouldn't mix innerHTML and setHTML, you would eliminate all usage of innerHTML and use the new setHTMLUnsafe if you needed the old functionality.
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#5Great to see this start to show up, but it looks like it will be a while before browser support is widely distributed enough to rely on it being present: https://caniuse.com/mdn-api_element_sethtml
Indeed, as any browser API, it might be for in a few years (months if happy with the most recent versions), and we may have polyfills in the meantime.
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#6A rather deceptive title, given that 'innerHTML' isn't going away.
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#7Great to see this start to show up, but it looks like it will be a while before browser support is widely distributed enough to rely on it being present: https://caniuse.com/mdn-api_element_sethtml
Indeed, as any browser API, it might be for in a few years (months if happy with the most recent versions), and we may have polyfills in the meantime.
[deleted]
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#8This is nice. The best part is that all aspects of network access are now properly controlled so that security transitioned from a chain of trusted code to a chain of trusted security setup on hosts, with existing workable safe defaults.
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#9Great to see this start to show up, but it looks like it will be a while before browser support is widely distributed enough to rely on it being present: https://caniuse.com/mdn-api_element_sethtml
Indeed, as any browser API, it might be for in a few years (months if happy with the most recent versions), and we may have polyfills in the meantime.
I wouldn't advise polyfills on this one, it entirely depends on the browser ability to evaluate cross scripting and cross origin rule on a arbitrary snippet. This is not a convenience API.
Re: Goodbye InnerHTML, Hello SetHTML: Stronger XSS Protection in Firefox 148
#10Nice one. Will there be any impact on __dangerouslySetInnerHTML (React)?