✍️ https://htmlparser.info & https://wpc.guide
| X | https://twitter.com/zcorpan |
| Bluesky | https://bsky.app/profile/zcorpan.bsky.social |
| X | https://twitter.com/zcorpan |
| Bluesky | https://bsky.app/profile/zcorpan.bsky.social |
Mozilla is looking for a Staff Security Engineer, Product Security in Remote Canada/US/UK/Germany - https://www.mozilla.org/en-US/careers/position/gh/7539147/
This role expects a significant level of experience in penetration testing, code review, SAST/DAST. (This is not my team, so I won't be able to answer a lot of the typical questions. But you'll get to work on cool products with lots of cool people! :))
Intutively for a DOM Sanitizer configuration that looks like the following:
{
elements: ["div", "span"],
attributes: ["class"],
}
For a <div> element, which attributes do you think should/would be allowed?
(Boost appreciated)
⚠️ Last chance to fill out #StateOfHTML 2025 and get browsers to pay attention to your web platform pain points!
After popular demand, the survey closing date has been extended for a few more days so that returning OOO folks get a chance to fill it out too!
https://survey.devographics.com/en-US/survey/state-of-html/2025/?source=leaverou
What is the issue with the HTML Standard? Elements that are parsed as RAWTEXT or RCDATA in HTML context but as normal elements in foreign content context have been used for mXSS vectors. Examples: ...
@securitymb Right. But script and style are actual SVG elements so those are likely most risky compat-wise.
Elements or character references or CDATA sections, or even comments.