Google CTF is on! Here's a challenge that I created:
* https://capturetheflag.withgoogle.com/challenges/web-lost-in-transliteration.
Good luck 😀
| Personal website | https://bentkowski.info |
| https://twitter.com/SecurityMB |
Michał Bentkowski (@SecurityMB) 🦻
- 598 Followers
- 92 Following
- 84 Posts
Information security engineer at Google. Opinions are mine.
Tom SchusterFirefox 140 just shipped, which means Firefox will now escape less-than (<) and greater-than (>) symbols when serializing HTML attributes.
HTML spec change:
https://github.com/whatwg/html/issues/6235
Firefox release notes:
https://www.mozilla.org/en-US/firefox/140.0/releasenotes/
Today we published two blog posts about an HTML specification change that makes mutation XSS harder to exploit! Long story short: `<` and `>` are now escaped in attributes.
* Blog post about security rationale behind this change: https://bughunters.google.com/blog/5038742869770240/escaping-and-in-attributes-how-it-helps-protect-against-mutation-xss
* Blog post about how it affects web developers: https://developer.chrome.com/blog/escape-attributes?hl=en
Blog: Escaping '<' and '>' in attributes – How it helps protect against mutation XSS
The HTML specification has been updated to escape '<' and '>' in attributes to prevent mutation XSS (mXSS) vulnerabilities. This post details the reasoning behind this change and explains why this update improves security.
So I'm starting a Youtube Channel 😄 Join me today at 19:00 CEST (in other words: in three hours) when I'll talk about 10 highlights from my bug hunting career:
My Twitter account BugsChromium is now also on Mastodon. You can follow @bugschromium if you wanna be up-to-date on Chromium disclosed bugs 😃
@jerry are you okay with bots registered on this instance? I'd like to create an equivalent of https://twitter.com/BugsChromium here.
I just added the side-by-side generation of DOM trees. You can test it on parser called "iframe (with scripts vs without scripts)".
For people who use my LiveDOM++ tool. I decided to create a new version of it here: https://livedom.bentkowski.info/
While currently there aren't really any new features compared to the previous version, I'm planning to add some new ones in the next few days, such as the ability to generate two DOM trees side by side.
Also, the source is now open: https://github.com/securityMB/livedom
daniel:// stenberg://