Securing Web Apps with Modern Platform Features (Google I/O ’19)
Common vulnerabilities such as XSS, CSRF, and others have long plagued the web, accounting for most of the high-risk flaws reported under Google's Vulnerability Reward Program. Learn about the latest web platform security mechanisms to protect your apps from injections and isolate them from dangerous sites. You'll leave with a security checklist for defending your applications with new browser fea
Cross-Site Scripting (XSS) | Snyk
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Bootstrap 3.4.0 · Bootstrap
The Bootstrap Blog News and announcements for all things Bootstrap, including new releases, and Bootstrap Icons. That’s not a typo—today we’re shipping Bootstrap 3.4.0, a long overdue update to address some quality of life issues, XSS fixes, and build tooling updates to make it easier for us, and you, to develop. While we’d planned for ages to do a fresh v3.x update, we lost steam as energy was fo
Third party CSS is not safe
A few days ago there was a lot of chatter about a 'keylogger' built in CSS. Some folks called for browsers to 'fix' it. Some folks dug a bit deeper and saw that it only affected sites built in React-like frameworks, and pointed the finger at React. But the real problem is thinking that third party content is 'safe'. Third party images If I include the above, I'm trusting example.com. They may betr
Preventing attacks on a user's history through CSS :visited selectors
Preventing attacks on a user's history through CSS :visited selectors L. David Baron, Mozilla Corporation Web browsers remember what pages a user has visited recently. They use this history for a number of things, such as making links a different color if the page they link to was visited and providing autocompletion in the URL bar. It's been widely known for a while that CSS's ability to style vi
CSS - The Sexy Assassin
The Sexy Assassin's Arsenal - Power optimized Concussion sticks (PoCs) Arithmetics Sums Multiplications chmod calc CSS Hangman Game CSK1 CSK2 Loops Stopmotion animation 7 segments counter binary counter Mouse tracking CSS Paint CSS Attribute Reading Attribute Reader History Reading CSS History Bool CSS LAN Scanner History Crawler
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
https://bugs.chromium.org/p/chromium/issues/detail?id=835589
CSS Injection ++ - 既存手法の概観と対策 - Speaker Deck
Login Form CSS only validation
Amazon.com: Security for Web Developers: Using JavaScript, HTML, and CSS: Mueller, John Paul: Books
Intent to Ship: Long Task API - Google Groups
Google Code Archive - Long-term storage for Google Code Project Hosting.
HTML5 Security Cheatsheet