Frederik Braun

This is a blog post about standards, their proliferation and the issues that may arise.

Dear reader.

The HTML Sanitizer API allows multiple ways to customize the default allow list and this blog post aims to describe a few variations and tricks we came up with while writing the specification.

TLDR: Use require-trusted-types-for 'script'; trusted-types 'none'; in your CSP and nothing besides setHTML() works, essentially removing all DOM-XSS risks.

Sanitizing HTML is the practice of taking a piece of HTML and removing some unwanted elements and attributes.

Today: Something off topic, to feed the search engines.

NB: This is the blog version of my keynote from Measurements, Attacks, and Defenses for the Web (MADWeb) 2025, earlier this year.

The Goal: Smart Heating Control Home automation is a cool toy but also allows my house hold to be more energy efficient: My aim was to configure my home's heating to switch off when my family is away and turn back on when we return.

NB: This is the text/html version of my talk from the German OWASP Day 2024 in Leipzig earlier this month.

I need help.

For those who don't know, I have provided countless contributions to the Mozilla project.

Welcome!

In web security, you may have heard of "mixed content".

Today, I found someone tweeting about a neat security bug in Chrome, that bypasses how Chrome disallows extensions from injecting JavaScript into special domains like chrome.google.com.

This is my update to the 2021 JavaScript IPC blog post from the Firefox Attack & Defense blog.

In order to fully discuss security issues, their common root causes and useful prevention or mitigation techniques, you will need some common ground on the security model of the web.

This article first appeared on the Firefox Attack & Defense blog.

This article first appeared on the HTMLHell Advent Calendar 2022.

This document sat in my archives.

Note: This is the reference sheet version.

This blog post has first appeared on the Mozilla Attack & Defense blog and was co-authored with Christoph Kerschbaumer and Tom Ritter In a recent academic publication titled Hardening Firefox against Injection Attacks (to appear at SecWeb – Designing Secu…

This blog post has first appeared on the Mozilla Attack & Defense blog and was co-authored with Christoph Kerschbaumer This is the first part of a blog post series that will allow you to understand how Firefox implements Web Security fundamentals, like the

This article first appeared on the Mozilla Security blog I recently gave a talk at OWASP Global AppSec in Amsterdam and summarized the presentation in a blog post about how to achieve "critical"-rated code execution vulnerabilities in Firefox with user-in…

This is the blog post version of my presentation form OWASP Global AppSec in Amsterdam 2019.

Life keeps me busy, which is why this blog is seeing less and less publications.

Update: In July 2019, Chrome developers announced that they are going to remove XSSAuditor.

For those who have not participated in my challenge, this document is about implementing security features in ServiceWorkers.

TLDR: If SSH is enabled in the advanced settings, you can just login with the default password 1234.

Background GitHub is one of the first big webistes using Subresource Integrity and can thus defend against potentially bad Content Delivery Networks (CDNs).

I have written two Firefox OS apps, which are both not very popular.

I found the address of the teacher's pinboard!

This blog post is the text-version of my presentation from OWASP AppSec EU 2015.

Earlier this week, Twitter rolled out a new account dashboard.

Deutsch Damals, als Firefox 1.0 herauskam, unterstützten hunderttausende Freiwillige das Spread Firefox-Projekt um eine Werbeanzeige in der New York Times zu kaufen.

Anonabox is not a magic bullet!

This article has been superseded by a more-recent write-up of my presentation from OWASP AppSec EU 2015.

On Firefox OS (FxOS), every app has its own set of permissions.

This is a short summary about a goofy XSS/CSRF exploit on an internal web page at Mozilla.

This article was also published in the third issue of the International Journal of PoC || GTFO.

This blog post about X-Frame-Options was originally published on the Mozilla Security Blog A few weeks ago, Mario Heiderich and I published a white paper about the X-Frame-Options security header.

I originally blogged about html2dom on the Mozilla Security Blog Having spent significant time to review the source code of some Firefox OS core apps, I noticed that a lot of developers like to use innerHTML (or insertAdjacentHTML).

I spent a few days working on a security review for Thunderbird's HTML sanitizer.

In our Security Disaster of the Week, H.

This is the first post of hopefully many.