Securing Web Apps with Modern Platform Features (Google I/O ’19)
Common vulnerabilities such as XSS, CSRF, and others have long plagued the web, accounting for most of the high-risk flaws reported under Google's Vulnerability Reward Program. Learn about the latest web platform security mechanisms to protect your apps from injections and isolate them from dangerous sites. You'll leave with a security checklist for defending your applications with new browser fea
Cross-Site Scripting (XSS) | Snyk
bootstrap is a popular front-end framework for faster and easier web development. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the data-target attribute. A cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source. This is done by escaping the context of the w
Bootstrap 3.4.0 · Bootstrap
The Bootstrap Blog News and announcements for all things Bootstrap, including new releases, Bootstrap Themes, and Bootstrap Icons. That’s not a typo—today we’re shipping Bootstrap 3.4.0, a long overdue update to address some quality of life issues, XSS fixes, and build tooling updates to make it easier for us, and you, to develop. While we’d planned for ages to do a fresh v3.x update, we lost stea
CSS Injection ++ - 既存手法の概観と対策 - Speaker Deck
「第19回ゼロから始めるセキュリティ入門 勉強会」での, CSS Injection の脅威と対策に関する short talk 用に作成した資料です :-) 勉強会ページ: https://weeyble-security.connpass.com/event/98127/ I explain some techniques of CSS Injection by @masatokinugawa, @SecurityMB, and other websec researchers in Japanese. I highly recommend to check the following awesome work by @SecurityMB and @0x6D6172696F. - https://sekurak.pl/wykradanie-danych-w-swietnym-styl
Third party CSS is not safe
A few days ago there was a lot of chatter about a 'keylogger' built in CSS. Some folks called for browsers to 'fix' it. Some folks dug a bit deeper and saw that it only affected sites built in React-like frameworks, and pointed the finger at React. But the real problem is thinking that third party content is 'safe'. Third party images If I include the above, I'm trusting example.com. They may betr
Preventing attacks on a user's history through CSS :visited selectors
Preventing attacks on a user's history through CSS :visited selectors L. David Baron, Mozilla Corporation Web browsers remember what pages a user has visited recently. They use this history for a number of things, such as making links a different color if the page they link to was visited and providing autocompletion in the URL bar. It's been widely known for a while that CSS's ability to style vi
CSS - The Sexy Assassin
The Sexy Assassin's Arsenal - Power optimized Concussion sticks (PoCs) Arithmetics Sums Multiplications chmod calc CSS Hangman Game CSK1 CSK2 Loops Stopmotion animation 7 segments counter binary counter Mouse tracking CSS Paint CSS Attribute Reading Attribute Reader History Reading CSS History Bool CSS LAN Scanner History Crawler
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
https://bugs.chromium.org/p/chromium/issues/detail?id=835589
Login Form CSS only validation
Amazon.com: Security for Web Developers: Using Javascript, Html, and CSS: Mueller, John Paul: Books
Intent to Ship: Long Task API - Google Groups
Google Code Archive - Long-term storage for Google Code Project Hosting.
HTML5 Security Cheatsheet