New CS proposal: DOM Clobbering Prevention

[SoheilKhodayari]

What is the proposed Cheat Sheet about?

DOM Clobbering vulnerabilities.

This CS will cover the basics about DOM Clobbering, describing examples of (in)secure coding patterns and guidelines for developers.

What security issues are commonly encountered related to this area?

Cross-Site Scripting (XSS)

What is the objective of the Cheat Sheet?

Describe what DOM Clobbering vulnerabilities are and discuss how to defend against them.

What other resources exist in this area?

• https://domclob.xyz
• HTMLHell: DOM Clobbering
• PortSwigger: DOM Clobbering Strikes Back
• PortSwigger: Hijacking Service Workers via DOM Clobbering
• Blogpost: XSS in GMail’s AMP4Email
• HackTricks: DOM Clobbering

[mackowski]

Hey @SoheilKhodayari good topic! Do you want to create this cheatsheet?

[SoheilKhodayari]

Hi @mackowski, great. I'll be more than happy to create a cheatsheet for this. I'll submit a PR within the next few weeks, thanks!