{
  "id": 49210,
  "guid": "89d4bbfd-cbcf-5d5c-a9f5-46d64729349c",
  "logo": "",
  "date": "2022-12-30T14:30:00+01:00",
  "start": "14:30",
  "duration": "01:00",
  "room": "HIP - Track 1 - Room 5",
  "slug": "jev22-49210-what_if_xss_was_a_browser_bug",
  "url": "https://pretalx.c3voc.de/hip-berlin-2022/talk/DYW8MV/",
  "title": "What if XSS was a browser bug?",
  "subtitle": "",
  "track": "E.T.I.",
  "type": "Talk",
  "language": "en",
  "abstract": "Cross-Site Scripting (XSS) is still the most common security issue on the web - with no easy way to be prevented. The talk will provide the necessary background on XSS and where previous approaches failed. Then we will present the Sanitizer API, a new and upcoming browser API that solves this issue.",
  "description": "We\u2019ll talk about mXSS and HTML parsing as background and then also explain why the XSS Auditor didn\u2019t work (as a prime example of a browser-controlled XSS mitigation). Using examples from recent mXSS attacks against sanitizers, we are explaining the root cause of these issues and the solution: Parsing needs to be done within a context-element. Then we will explain how a built-in Sanitizer API can fill the existing gap and what it can and can not protect against, looking at more recent attacks like DOM Clobbering and script gadgets.",
  "recording_license": "",
  "do_not_record": false,
  "persons": [
    {
      "id": 3336,
      "code": "CXPRTW",
      "public_name": "Frederik Braun",
      "biography": "Frederik Braun works as a Staff Security Engineer for Mozilla Firefox in Berlin. He\u2019s also a member of the W3C Web Application Security Working Group where he co-authored the Subresource Integrity standard. When not at work, Frederik goes on long bike treks across Europe with his wife and two kids.",
      "answers": []
    }
  ],
  "links": [],
  "attachments": [],
  "room_id": "a24f561b-6f4a-4ee3-87fb-d22fff05f0da",
  "origin": "pretalx.c3voc.de"
}