Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
A DOM XSS Sink Inventory for Angular: ElementRef, Renderer2, Dynamic URLs, HTML-Producing Libraries and a Code Review Checklist
Angular only sanitizes its own template bindings; ElementRef.nativeElement, Renderer2.setProperty/setAttribute, insertAdjacentHTML, dynamic script and iframe sources and HTML-producing libraries are unprotected. In this post we show these sinks in headless Chrome, fix them with the template and DomSanitizer, compare marked, DOMPurify and setHTML, and build a grep and ESLint based code review checklist.
Razor Syntax and Layouts: @ Expressions, HTML Encoding, _Layout, Sections, _ViewStart and _ViewImports
Razor HTML-encodes every value written with @ by default; that shuts out XSS but also turns non-ASCII letters such as Turkish ı into entities like ı, fixed with WebEncoderOptions. With real output we cover implicit vs explicit expressions, the danger of Html.Raw and of embedding '@Model' in JavaScript, Json.Serialize, sections, the _ViewStart/_ViewImports hierarchy and the lost-section error in nested layouts.
OWASP A05: Injection (2) — XSS, Razor Encoding, innerHTML, CSP and Trusted Types
We examine reflected, stored and DOM-based XSS in the Bookstore lab: HtmlEncoder and Razor's automatic encoding, the trap of writing a value from a JSON API with innerHTML and the textContent fix, Angular's sanitization and the bypassSecurityTrust* risk, then how CSP and Trusted Types stop unsafe code in headless Chrome as a second line of defense.
Intro to the JavaScript DOM: Selecting, Changing and Creating Elements
We meet the DOM tree the browser builds from HTML, select elements with querySelector, see why textContent and innerHTML differ and what XSS is, then change the page live with classList and createElement.