Step 3 / Select topic Frontend Security Medium
What this bank covers
- Identifying the HTML-parsing sink
- location.hash keeps the '#'
- Case-sensitive blacklists fail
- createTextNode never creates elements
- Event-handler attributes survive innerHTML parsing
- insertAdjacentHTML is also an HTML sink
- URL sources are already decoded
- setAttribute does not sanitize URLs
- textContent is the safe text sink
- Single-pass blacklist removal is bypassable
- textContent assignment escapes markup on serialization
- Single-pass tag removal can create the tag it removed
- DOMParser produces an inert document
- Attribute serialization escapes quotes but not angle brackets
- URL scheme checks must be case-insensitive
- Reading textContent strips tags but keeps nested text
- tagName is uppercase for HTML elements
- Attribute allowlisting with getAttributeNames
- Regex tag stripping misparses quoted angle brackets
- template.innerHTML fills the inert content fragment
- Relative URL resolution with a leading slash
- URL.protocol includes the colon
- host versus hostname
- Protocol-relative references change the authority
- searchParams.get with duplicate keys
- encodeURIComponent escapes query delimiters
- Dangerous schemes parse successfully
- Default ports are normalized away
- URLSearchParams serializes spaces as plus
- Dot-segment normalization in paths
- targetOrigin wildcard
- Shape of event.origin
- Opaque origins in messages
- Structured clone and functions
- Clonable built-ins
- Messages are copies, not references
- Validating event.origin
- How targetOrigin is compared
- Cycles in structured clone
- Prototypes are not cloned
- Recursive merge with a __proto__ key
- Prototype-less objects as a mitigation
- Freezing Object.prototype
- constructor.prototype bypasses a __proto__ blocklist
- defineProperty sidesteps the __proto__ setter
- Map lookups ignore prototype pollution
- for...in walks the prototype chain
- Choosing a complete key blocklist
- Pollution turns an empty config into attributes
- Polluted numeric keys leak into arrays
- protocol-relative redirect targets
- startsWith('/') is not a local-path check
- endsWith allows sibling domains
- resolve, then compare origins
- scheme allow-list on a parsed redirect target
- validating before decoding
- rebuilding a same-origin redirect target
- Protocol-relative redirect targets
- Userinfo in redirect targets
- Origin allow-lists for redirects
- Directive fallback to default-src
- Nonces override 'unsafe-inline'
- Wildcard host-source matching
- Duplicate directives inside one policy
- Scheme-source matching
- Multiple CSP headers are enforced independently
- Reading a policy from a meta element
- Directives that only work in a header
- What 'self' actually matches
- 'strict-dynamic' discards host and scheme sources
- Set-Cookie name/value split
- Cookie path matching
- __Host- cookie prefix
- SameSite=Lax on navigations
- Cookie domain matching
- document.cookie is write-only for attributes
- Max-Age beats Expires
- Substring cookie lookup is unsafe
- Strict secure cookies
- SameSite=None requires Secure
- Simple requests vs preflighted requests
- Serializing an origin for the Origin header
- CORS-safelisted response headers
- Caching a preflight result
- Credentialed CORS requires an exact origin
- Wildcards in Access-Control-Allow-Methods
- Preflight request headers
- Access-Control-Allow-Credentials value
- X-Frame-Options values
- iframe sandbox tokens
- window.top in a frame
- CSP frame-ancestors matching
- frame-ancestors versus X-Frame-Options
- allow-scripts without allow-same-origin
- empty sandbox attribute
- sandbox token list parsing
- SAMEORIGIN compares full origins
- detecting a framed document
- Safelisted Content-Type values
- Wildcard origin with credentials