Mike Samuel mikesamuel

Auto-noncing in Go html/template

Background

CSP mitigates many client-side security vulnerabilities. A policy is a whitelist of locations from which JavaScript, Styles, and other content can be loaded. CSP allows nonces & hashes to make it easy for a policy to allow some inline content without allowing all inline content.

Secure Header Set

_{^{tinyurl.com/sec-header-sets}}

A proposed library that provides safe defaults (with opt-out) for security-relevant HTTP response headers.

Secure Header Set
Background

Hello, World!

URL Classifier Builder

This is now implemented: https://github.com/OWASP/url-classifier

Problem

Matching URLs with regular expressions is hard. Even experienced programmers who are familiar with the URL spec produce code like /http:\/\/example.com/ which spuriously matches unintended URLs like

Node Frenemies

Lets project teams trust code they know with more than code they don't.

Goal
Non-goals
Use Case Summary
Solution: Node module loader acts as trusted intermediary to enable mutual suspicion
- Reliable Channel Example

Example Code

Options for Hardening React &| JSX

Background
Problem
Options
Hybrid of Before Desugar and Mutate Reconciler

	private static final boolean DEBUG_RDS = false;
	static void removeDotSegmentsInPlace(StringBuilder path, int left) {
	// The code below has excerpts from the spec interspersed.
	// The "input buffer" and "output buffer" referred to in the spec
	// are both just regions of path.
	// The loop deals with the exclusive cases by continuing instead
	// of proceeding to the bottom.
	boolean isAbsolute = left < path.length() && path.charAt(left) == '/';

	// RFC 3986 Section 5.2.4

	<html>
	<title>sanitize-html testbed</title>
	<script>
	// Inlined the result of
	// $ npm install sanitize-html
	// $ browserify --bare node_modules/sanitize-html/index.js
	// and added window.sanitizeHtml = sanitizeHtml;

	(function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++)s(r[o]);return s})({1:[function(require,module,exports){
	var htmlparser = require('htmlparser2');

	"use strict";

	// Prompted by https://esdiscuss.org/topic/json-canonicalize

	// Given a string of JSON produces a string of JSON without unnecessary
	// degrees of freedom like whitespace, optional escape sequences, and
	// unnecessary variance in number representation.
	function hashable(json) {
	const strs = [] // Side table to collect string bodies
	return reorderProperties(

	JSON.parse = (() => {
	const undef = void 0;
	const jsonParse = JSON.parse;
	function noProtoReviver (key, value) {
	if (key === '__proto__') {
	console.warn('Removed __proto__ from parsed JSON');
	return undef; // Remove property entirely
	}
	return value;
	}