Security
Security
Navigation mit Esc, → und ↓
bit.ly/HTML5Sec
Interaktive Version der Präsentation!
bit.ly/HTML5Sec
Interaktive Version der Präsentation!
```javascript contenteditable data-show-source="examples/svg/smilie.svg"
loading source...
```
```html contenteditable data-show-source="examples/svg/sad_smilie.svg" small
loading source...
```
[» http://html5sec.org](http://html5sec.org)
| & | → | & |
| < | → | < |
| > | → | > |
| " | → | " |
| ' | → | ' / ' |
| a-z A-Z 0-9 | → | immun |
| , . - _ | → | immun |
| Rest | → | &#xHH; |
- HTML parser runs before the JavaScript parser!
- you are doing it wrong
- ob Cookies
- ob Session Storage
- ob Local Storage
- ob WebSQL
die Daten sind nicht vertrauenswürdig!
Resident XSS
 |
 |
SQL Injection: ```html contenteditable executeSql("SELECT foo FROM bar WHERE value=" + value); ```
Prepared Statement: ```html contenteditable executeSql("SELECT foo FROM bar WHERE value=?", [value]); ```
JSON with Padding ```html contenteditable data-show-source="examples/jsonp/jsonp_by_hand.html" loading source... ``` ```html contenteditable foo({"hello": "world"}); ``` [» Demo](examples/jsonp/jsonp_by_hand.html)