Die Labs / Security
SecurityWorking~4h
An Input Sanitizer That Actually Stops XSS
A sanitization layer sitting between untrusted user input (e.g. a comment or bio field) and both storage and render, using an allowlist-based HTML sanitizer rather than hand-rolled regex escaping. You feed it a battery of real-world stored-XSS payloads and prove each one is neutralized on render, not just on the happy path.
Was er beweist
Der Satz, den du im Vorstellungsgespräch verteidigen kannst.
Lebenslauf-Zeile
Closed a stored-XSS vulnerability in a user-generated-content field by replacing ad-hoc regex escaping with an allowlist-based sanitizer, verified against a 12-payload OWASP-derived attack corpus with zero script execution.
- understands why blocklist regex XSS filters fail
- can implement allowlist sanitization correctly
- writes verifiable proof, not just 'looks safe'
Die Aufgabenstellung
Was du Schritt für Schritt baust.
- 01A working before-state: a comment/bio field that stores and renders raw user HTML with no sanitization, deliberately vulnerable, used as the control case
- 02Sanitization applied at write-time using an allowlist library (permitted tags/attributes explicitly enumerated) rather than a custom regex or blocklist
- 03A corpus of at least 12 real stored-XSS payloads (script tags, event-handler attributes like onerror/onload, javascript: URIs, SVG/foreignObject vectors, encoded/obfuscated variants) sourced from OWASP's XSS filter evasion cheat sheet
- 04Each payload submitted through the actual form/API, stored, then rendered in a real headless browser session with a script-execution detector (e.g. a page.on('dialog') or window flag hook) to prove no JS ran
- 05Legitimate formatting (bold, links, line breaks) still renders correctly after sanitization — prove the fix doesn't just strip everything
- 06A short writeup explaining why a regex-based blocklist approach fails against at least 2 of the corpus payloads (e.g. case variation, encoding, nested tags)
Der Beweis
Fertig, wenn diese Tests bestehen.
Automated Playwright suite submits all 12+ payloads and asserts zero script executions across all of them
automated test
Same suite run against the unsanitized 'before' version fails on at least 8 of the payloads, proving the vulnerability was real
automated test
Allowlisted formatting (bold/link/line-break) renders correctly post-sanitization
checked output
Writeup identifies the specific evasion technique that defeats naive regex escaping
reviewed
Stack
Node.js/Express or similarDOMPurify or sanitize-html (server-side allowlist sanitizer)Playwright (headless browser to prove script non-execution)a comment/note feature as the vulnerable surface
Sage Method
frame → decide → prove
Du behältst
Sanitizer implementation + before/after code diff + Playwright test suite with pass/fail report for all 12+ payloads + short writeup