0

That may not be the best way to phrase the question, but gives the basic idea.

If everything client-side is malleable, is it even worth it to use a JS library for sanitization?

I've seen DOMPurify recommended a few times recently and have read their security document (though it didn't provide the information I thought it might), and this isn't intended as a criticism of the effort or people behind it, or its quality.

However if you can't trust anything on the user's end, and ultimately need to process on the server anyway, then is it worth even adding another dependency and download?

It might be said that a library like that isn't large (especially compared to the JS and CSS frameworks people are using), and that it also helps protect against less advanced attacks, so adds some benefit without much cost.

But I'm still not sure if it adds enough value to include, as XSS involves targeting other users through the Web (and thus servers) by definition.

What do you think?

  • 1
    You should use this type of library when displaying data coming from the server, not when sending data to the server. The DOMPurity Threat Model seems to give this for granted and does not explain it though. – Enos D'Andrea Mar 9 at 8:52
3

However if you can't trust anything on the user's end, and ultimately need to process on the server anyway,

DOMPurify is not to protect the server against malicious input from the client.

It is to protect the client against maybe not fully sanitized data from the server but also input from other untrusted sources which might not even be visible to the server providing the main HTML. This might be for example when including third party content or when processing the hash of the URL (i.e. http://example.com/page#hash - the hash is not sent to the server).

  • That makes more sense, thank you! – SexxLuthor Mar 10 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.