Later archive addition

Prototype Pollution and bypassing client-side HTML sanitizers

Michał Bentkowski

Client-side HTML sanitizers read their allow-lists from configuration objects, so a prototype pollution primitive can add tags and attributes back in. DOMPurify, sanitize-html, js-xss and Google Closure are each bypassed this way, turning pollution into XSS, and Closure can additionally be pointed at an attacker-hosted script path.

Record

Researcher

Michał Bentkowski

In the archive

• Added to the 2020 archive after the original list was published

Related sources

• Research XSS challenge
• Research tools and examples

Tags

• prototype-pollution
• sanitizer-bypass
• xss
• gadget-chain
• filter-bypass
• javascript
• nodejs
• tooling
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Michał Bentkowski, first published at the original source. Preserved copies are kept so the citation survives its host.