Tag
dom-xss
- Aug 6, 2026 Trusted Types and the Typing of DOM XSS Sinks How require-trusted-types-for turns string assignment into a checked operation, what a policy must do beyond returning its input, and how the enforcement spreads across a codebase without freezing releases. web platform
- Jan 28, 2026 DOM XSS: Sources, Sinks, and Why the Server Never Sees the Payload How client-side flow from attacker-controlled input to an executing sink bypasses server-side encoding, and which of the flow-tracking approaches can follow the value. security