DOMPurify, Security in the DOM, and Why We Really Need Both [pdf]

I am always irrationally(?) scared of using these sanitizers despite their successful history. As soon as new html/js/css syntax/features are introduced, won't your security model need to be reevaluated? Which seems like a lost cause at the rate new capabilities are introduced to the web. E.g., when CSS Shaders lands, you might be able to execute arbitrary gpu code with just css (hypothetically speaking, I don't actually know how it will work. I am sure it'll be sandboxed pretty well. But the problem remains that there are too many new possibilities to keep up with!).

Make it a whitelist. :)

DOMPurify (as a client-side sanitizer) uses a whitelist. There's also CSP for defense-in-depth.

I would be more concerned of using server-side sanitizers due to the impedance mismatch between client/server HTML parsing algorithms.

It wouldn't help if new features extend the capabilities of existing stuff (which is done all the time). For example the CSS Shader example from before adds new syntax to the existing 'filter' css style, which you might've already whitelisted because it is safe today.

Security models are constantly being re-evaluated as new threats and attack vectors emerge.

What you said can be generically applied to every security control and which is why security is hard.

I guess a nested, parameter-granularity whitelist would work in that case :)

You can do that with DOMPurify using hooks.

Isn't that like saying there's no point in using an anti virus as viruses are always evolving?

You're still catching entire classes of existing issues..

> Isn't that like saying there's no point in using an anti virus as viruses are always evolving?

You're very close to understanding something.

(Though in defense of DOM purifiers they can use a whitelist)

Bad example. Anti virus software is a scam. Just adds another attack vector when the anti virus software has a bug in their file parsing & makes it that you can be impacted by just downloading a malicious file

Windows Defender is sufficient & bundled with Windows

You mean, you are catching exploits for vulnerabilities that don't exist anymore, and you pay for that with a gigantic attack surface that can be used to compromise you? Yeah, that sounds about right.

I mean I never said anything about buying one you just assumed that. I also just use windows defender of which part of that is an anti virus..