0:00 / 0:00

XSS on Google Search - Sanitizing HTML in The Client?

Name: XSS on Google Search - Sanitizing HTML in The Client?
Uploaded: 2019-03-31T11:57:21Z
Duration: 12 min 58 s
Channel: LiveOverflow
Description: LiveOverflow explains a mutation XSS vulnerability in Google Search caused by parsing differentials between JavaScript-enabled and disabled contexts.

LiveOverflow

949K subscribers • 11 videos on Hallway

YouTube

Recommended by 2 people: 1 on Lobsters and 1 in engineering communities.
Presented by LiveOverflow
Linked in the descriptiongoogle/closure-library
May be out of date. Uploaded 7 years ago, in an area where tools change fast.

Advanced. Deep dive for people who know the field.

700K views7 years ago2 recommendations

Security Web development Web and application security Exploits and vulnerabilities How browsers work

LiveOverflow explains a mutation XSS vulnerability in Google Search caused by parsing differentials between JavaScript-enabled and disabled contexts.

An actual XSS on google.com by Masato Kinugawa. It abuses a parsing differential between a JavaScript enabled and disabled context. LEARN ON HEXTREE (ad) Learn hacking on Hextree: hextree.io/ Watch this video and more on Hextree: app.hextree.io/courses/yt-xss/xss-in-google Join the Hextree Discord: discord.gg/xgQpCQCpvy The fix: github.com/google/closure-library/commit/c79ab48e8e962fee57e… CHAPTERS - Triggering XSS on Google Search - Why Sanitizing Allowed HTML Is Hard - Why HTML Sanitization Moves into the Browser - Invalid Markup and Browser Parsing Contexts - Mutation XSS and Server-Side Sanitizer Limits - How DOMPurify Uses the Template Element - Masato Kinugawa's noscript Payload - The Scripting-Enabled Parsing Differential - Debugging the Google Search XSS - The Closure Library Regression and Fix SUPPORT Per video: patreon.com/join/liveoverflow Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: youtube.com/LiveUnderflow Twitch: twitch.tv/LiveOverflow/ Twitter: twitter.com/LiveOverflow/ Instagram: instagram.com/LiveOverflow/ TikTok: tiktok.com/@liveoverflow_ LiveOverflow blog: liveoverflow.com/ Hextree blog (ad): hextree.io/blog #WebSecurity #BrowserSecurity #LiveOverflow (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.

Why it's here

2 people recommend this

What people say. Recommended as an excellent deep dive into mutation XSS and browser HTML parsing quirks.