[HN Gopher] Lexss: Bypassing Lexical Parsing Security Controls
       ___________________________________________________________________
        
       Lexss: Bypassing Lexical Parsing Security Controls
        
       Author : todsacerdoti
       Score  : 15 points
       Date   : 2021-06-25 08:56 UTC (2 days ago)
        
 (HTM) web link (labs.bishopfox.com)
 (TXT) w3m dump (labs.bishopfox.com)
        
       | dwheeler wrote:
       | For developers, the key is this:
       | 
       | > organizations should consider implementing a content security
       | policy (CSP) into the application [and] avoid directives such as
       | unsafe-inline or unsafe-eval
       | 
       | The problem with countering cross-site scripting is that you have
       | to be absolutely perfect in the massive number of output
       | locations. It is a good idea to try, and to use a framework that
       | automatically escapes things properly. But CSP works every time,
       | without requiring perfection.
        
         | bawolff wrote:
         | I would also say that in addition to csp being awesome,
         | escaping user controllled output is generally safer (when
         | practical) than trying to parse and sanitize html, due to how
         | tricky html is.
        
       ___________________________________________________________________
       (page generated 2021-06-27 23:03 UTC)