OWASP AppSec EU 2013: Insane in the IFRAME -- The case for client-side HTML sanitization
Channel: Christiaan008
Date: 2013-12-08

For more information and to download the video visit: http://bit.ly/appseceu13
Playlist OWASP AppSec EU 2013: http://bit.ly/plappseceu13

Speaker: David Ross

Server-side HTML sanitization is a familiar web application building block, yet despite years of offensive security research, defensive "sanitizer science" is still a kind of voodoo magic. This talk will make the case that as server-side HTML sanitizers lack the ability to effectively simulate every potential user agent, the client itself is the only party empowered to perform accurate sanitization. We will examine the DOM API primitives required to perform such client-side sanitization and review results and learning from a prototype implementation. 

Bio: 
David Ross is a Principal Security Software Engineer on the MSRC Engineering team at Microsoft. Prior to joining MSRC Engineering in 2002, Ross spent his formative years on the Internet Explorer Security Team.