Auto-patching DOM-based XSS at scale
Reining in the web with content security policy