Tag
content-security-policy
- Aug 6, 2026 Trusted Types and the Typing of DOM XSS Sinks How require-trusted-types-for turns string assignment into a checked operation, what a policy must do beyond returning its input, and how the enforcement spreads across a codebase without freezing releases. web platform
- May 27, 2026 Content Security Policy: Source Lists, Nonces, and Trust Propagation How CSP directives fall back to default-src, why host allowlists leak through JSONP and open redirects, and how nonces plus strict-dynamic move script trust to runtime provenance. web platform
- Jul 2, 2025 CSP Nonces and the Script Gadgets That Survive Them How a nonce marks the scripts a policy permits, why whitelisting a host also authorises every script on it, and how existing library code becomes an execution path. security
- Mar 27, 2022 HTML Parsing Contexts and Why One Escape Function Is Never Enough How the HTML tokenizer switches states by context, what each state treats as dangerous, and why encoding rules must be chosen per insertion point rather than per application. security