261 reputation
27
bio website inwader.com
location Sweden
age
visits member for 3 years, 3 months
seen Dec 12 at 15:50

Software developer at Spotify. Software hobbyist in my spare time.


Sep
24
awarded  Autobiographer
Sep
8
comment Is it safe to use createHTMLDocument to sanitize HTML?
mXSS is really interesting and make you feel that html sanitize is a sad mess to deal with :) I guess server side sanitize is the only "sane" way but still really really hard and a never ending battle.
Feb
5
comment Is it safe to use createHTMLDocument to sanitize HTML?
Did NOT know about* :)
Feb
5
revised Is it safe to use createHTMLDocument to sanitize HTML?
deleted 1 characters in body
Feb
5
revised Is it safe to use createHTMLDocument to sanitize HTML?
added 89 characters in body
Feb
5
comment Is it safe to use createHTMLDocument to sanitize HTML?
In the case I mention wouldn't a bug in a sanitized be equally bad either if it's done server or client side?
Feb
5
comment Is it safe to use createHTMLDocument to sanitize HTML?
Thanks, did know about DOMParser. Ok good to know, i noticed that Chrome tries to fetch img tags even when in a detached dom tree but does not if in a new document.
Feb
5
awarded  Student
Feb
5
comment Is it safe to use createHTMLDocument to sanitize HTML?
How would you bypass it? lets say this is a case where some client side javascript fetches from a server API that returns unsafe html that you would like to sanitize and insert into the page
Feb
5
asked Is it safe to use createHTMLDocument to sanitize HTML?
Sep
7
revised How to patch against RefRef's DOS attack
added 67 characters in body
Aug
13
revised How to patch against RefRef's DOS attack
edited body
Sep
1
awarded  Yearling
Aug
21
awarded  Caucus
Aug
21
awarded  Constituent
Jan
5
awarded  Supporter
Jan
2
awarded  Nice Answer
Sep
18
comment How to patch against RefRef's DOS attack
Quite sure query string refer to the part after "?" for the requested resource. So it will not match on the POST content. But mod_security seams to be able to do it. Still the real solution is to do proper query construction.
Sep
1
awarded  Editor
Sep
1
revised How to patch against RefRef's DOS attack
typo