Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header:

X-XSS-Protection: 1; mode=block

As I understand it, it prevents reflected XSS attacks by checking that the document does not contain any fishy looking parts of the query string as it loades. For a modern SPA this is not very useful. The HTML loaded directly from the server is often just static, and all the interesting stuff happends after the page has loaded.

Are there any browsers that have XSS filters that also prevents DOM based XSS? A filter like that would for instance check that something passed to .innerHTML is not a malicious reflection from the query string or any other user input, like a textbox.

Is this a thing? Do I have anything to gain from enabling the XSS filter on a SPA?

I do not believe there is anything in any browser exactly like what you are describing. However a Content Security Policy could accomplish what you are looking for, in a more-robust way.

For example, if your CSP prevents inline scripting you could effectively prevent any JavaScript passed to innerHTML from executing. Note that script tags are normally stripped from innerHTML, but the CSP would also prevent any inline on* attributes from executing. This does of-course mean you won't be able to use inline scripting yourself (at-least without explicitly allowing specific script content), but that's generally considered good practice anyhow.

Trusted Types are coming to get rid of DOM XSS.

There are various implementations of them, including Chrome future features:

google-chrome-unstable --enable-blink-features=TrustedDOMTypes --enable-experimental-web-platform-features

Or separate polyfill: https://github.com/WICG/trusted-types

Or even tinyfill like this: TrustedTypes={createPolicy:(n, rules) => rules}

Detailed description available here: https://gadgets.kotowicz.net/poc/Trusted_Types_TPAC_2018.pdf

  • This is interesting, but I am not sure it answers my question. I am interested in the XSS-filters that you control through the X-XSS-Protection header, and not in mitigation of DOM-based XSS in general. – Anders Nov 2 at 9:33
  • You can control this "DOM-XSS-filter" through the js policy as well. – odo Nov 2 at 10:14
  • I'm not talking about solving it with JS. I am talking about a specific HTTP header. – Anders Nov 2 at 10:16

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.