What is a realm in JavaScript?
What is a realm in JavaScript? 28 Oct 2022 As part of my long term research around browser JavaScript security, in the past year I have been focusing specifically on security for realms ⭐️. Due to the rise of dependencies-based development, the JavaScript ecosystem (and the browser JavaScript ecosystem in particular) is far more vulnerable to what we know as “supply chain attacks” - and the abilit
SES support for ECMAScript modules
SES v0.8.0Up to this point, SES has supported evaluating scripts in the SES runtime. Since every non-trivial application has many modules, running an application previously required creating a script bundle with a tool like Browserify. We’re excited to announce the first release of SES that directly supports loading ECMAScript modules. This is the first in a series of milestones toward delivering
GitHub - Agoric/SES: MOVED to @agoric/ses-shim. SES (Secure EcmaScript) is a secure runtime for running third-party code safely
This repository contains the code for "Old SES": the one whose default export is a single object named SES, which has a property named SES.makeSESRootRealm(). This code was used to make all NPM releases of the SES package up through the '0.6.x' series. Modern SES development is now happening in the SES-shim repository. This "New SES" has a named export named lockdown(), which introduces the Compar
GitHub - Agoric/realms-shim: Spec-compliant shim for Realms TC39 Proposal
This repository contains a legacy shim implementation of an outdated Realm API Proposal. The Realms proposal has been superceded by the ShadowRealm Proposal. This shim does not implement ShadowRealm, which (as of this writing) is a proposal at Stage 3 of the TC39 standardization process, so common JS engines should have support soon. We do not recommend the use of this shim or the original Realms
GitHub - mikewest/tc39-proposal-literals: Literals could be different than non-literals.
HTML's DOM offers a number of mechanisms to turn arbitrary strings into markup (.innerHTML = ...) or code (scriptEl.innerText = ..., el.onclick = ..., etc). Each of these mechanisms can serve as an XSS sink, giving an attacker the ability to feed code into a context that wasn't expecting it, leading to a class of DOM-based XSS attacks that we'd very much like to avoid. One way of addressing this i
Masato Kinugawa Security Blog: U+2028/2029とDOM based XSS
ECMAScriptの仕様では、0x0A/0x0D以外にU+2028/2029の文字も改行とすることが明記されています。 これはあまり知られていないように思います。 以下はアラートを出します。 <script> //[U+2028]alert(1) </script> 知られていないだけでなく、知っていたとしても、スクリプトで文字列を処理するときに、U+2028/2029まで考慮する開発者がどれだけいるのかという話です。 実際、U+2028/2029を放り込むと文字列リテラル内にその文字が生のまま配置され、エラーが出るページは本当にたくさんあります。まあ、エラーがでるだけなら、大抵の場合大きな問題にはなりません。 ところが、U+2028/2029によってXSSが引き起こされてしまう場合というのを最近実際に見ました。 Googleのサービスで見つけた2つのケースを取り上げたいと思います。 ケ
Visual Studio Code - NEW FEATURES: 11 Funtastic Editor Updates (New Themes, Keyboard Accessibility, Screen Reader, Localization, Ligatures, Find Widget, Input Handling, Cursor Style, Auto Save, File Picker, & IntelliSense Documentation) - User Ed - The bl
Microsoft is holding an AI Agents Hackathon, and we want to see what you can build with Python! We'll have 20+ live streams showing you how to build AI agents with Python using popular agent frameworks and Microsoft technologies. Then, you can submit your project for a chance to win prizes, including a Best in Python prize!
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Define security around Window, WindowProxy, and Location properly · whatwg/html@acae3df
Intent to Ship: Long Task API - Google Groups