Mozilla last week revised its position on a web security technology called Trusted Types, which it has decided to implement in its Firefox browser.
The browser biz will help reduce a longstanding form of web attack that relies on injected code.
Mozilla won't implement Trusted Types in Firefox immediately - there are still some technical issues to sort out.
The org's decision is a win for web security, which has been looking up since May 2020 when Trusted Types shipped in Chrome 83 and Edge 83.
Trusted Types addresses DOM-XSS, or document object model cross-site scripting - considered to be both rather dangerous and fairly common.
XSS attacks should become less common as more websites revise their code to take advantage of Trusted Types.
Or, as Vogelheim continued, they are made possible when developers fail to sanitize their app's inputs.
With Trusted Types enabled, the browser expects a TrustedHTML object instead of a text snippet.
Trusted Types addresses the risk of unsafe input by limiting the attack surface via Content Security Policy and a content filtering mechanism.
Since the capability first showed up three years ago, DOM-XSS attacks have become less common in the Chromium ecosystem.
In an October post to the GitHub repo discussing Mozilla's positions on various technologies, Vogelheim notes that Google expects to effectively eliminate DOM-XSS risk as it deploys Trusted Types across all of Google's websites.
I believe that broader support across browsers and broader deployment across websites would be beneficial to the web platform overall.
Toward that end, Niemczura pointed to a post he made in May urging Apple's WebKit team to consider adopting Trusted Types based on successful deployment by Google, Meta, and Microsoft across various websites.
Currently, Trusted Types is present or enforced in about ten percent of Chrome web page loads.
Bruce Perens, a veteran programmer and one of the founders of the Open Source movement, expressed enthusiasm for the technology after deploying it.
Perens said that while Trusted Types are only enforced in some browsers, developers should adapt their web app code to support the XSS defense because he believes Firefox, Safari, and other browsers will eventually include the technology.
This Cyber News was published on go.theregister.com. Publication date: Thu, 21 Dec 2023 11:43:04 +0000