Los Laboratorios / Security
SecurityWorking~4h
An Input Sanitizer That Actually Stops XSS
A sanitization layer sitting between untrusted user input (e.g. a comment or bio field) and both storage and render, using an allowlist-based HTML sanitizer rather than hand-rolled regex escaping. You feed it a battery of real-world stored-XSS payloads and prove each one is neutralized on render, not just on the happy path.
Lo que demuestra
La frase que puedes defender en una entrevista.
Línea de currículum
Closed a stored-XSS vulnerability in a user-generated-content field by replacing ad-hoc regex escaping with an allowlist-based sanitizer, verified against a 12-payload OWASP-derived attack corpus with zero script execution.
- understands why blocklist regex XSS filters fail
- can implement allowlist sanitization correctly
- writes verifiable proof, not just 'looks safe'
El resumen
Lo que construyes, paso a paso.
- 01A working before-state: a comment/bio field that stores and renders raw user HTML with no sanitization, deliberately vulnerable, used as the control case
- 02Sanitization applied at write-time using an allowlist library (permitted tags/attributes explicitly enumerated) rather than a custom regex or blocklist
- 03A corpus of at least 12 real stored-XSS payloads (script tags, event-handler attributes like onerror/onload, javascript: URIs, SVG/foreignObject vectors, encoded/obfuscated variants) sourced from OWASP's XSS filter evasion cheat sheet
- 04Each payload submitted through the actual form/API, stored, then rendered in a real headless browser session with a script-execution detector (e.g. a page.on('dialog') or window flag hook) to prove no JS ran
- 05Legitimate formatting (bold, links, line breaks) still renders correctly after sanitization — prove the fix doesn't just strip everything
- 06A short writeup explaining why a regex-based blocklist approach fails against at least 2 of the corpus payloads (e.g. case variation, encoding, nested tags)
La prueba
Está terminado cuando estos pasan.
Automated Playwright suite submits all 12+ payloads and asserts zero script executions across all of them
automated test
Same suite run against the unsanitized 'before' version fails on at least 8 of the payloads, proving the vulnerability was real
automated test
Allowlisted formatting (bold/link/line-break) renders correctly post-sanitization
checked output
Writeup identifies the specific evasion technique that defeats naive regex escaping
reviewed
Stack
Node.js/Express or similarDOMPurify or sanitize-html (server-side allowlist sanitizer)Playwright (headless browser to prove script non-execution)a comment/note feature as the vulnerable surface
Método Sage
frame → decide → prove
Conservas
Sanitizer implementation + before/after code diff + Playwright test suite with pass/fail report for all 12+ payloads + short writeup