Articles tagged DOM-based XSS

Stopping DOM-Based XSS with Trusted Types and CSP

A strict CSP stops injected script tags, but DOM-based XSS sneaks attacker input into sinks like innerHTML and eval that your own trusted code already runs. Trusted Types, shipped through CSP, makes those sinks refuse raw strings and closes the gap.