{"id":19213630,"url":"https://github.com/0xsobky/xssbuster","last_synced_at":"2025-05-12T22:18:04.614Z","repository":{"id":41232643,"uuid":"75525472","full_name":"0xSobky/XSSBuster","owner":"0xSobky","description":"XSSB is a proactive DOM sanitizer, defending against client-side injection attacks!","archived":false,"fork":false,"pushed_at":"2018-08-26T21:37:58.000Z","size":102,"stargazers_count":38,"open_issues_count":0,"forks_count":8,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-05-12T22:17:45.515Z","etag":null,"topics":["dom-xss","injection-attacks","web-security","xss","xss-filter"],"latest_commit_sha":null,"homepage":"https://xssb.herokuapp.com/","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xSobky.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-12-04T08:16:03.000Z","updated_at":"2024-11-12T04:44:35.000Z","dependencies_parsed_at":"2022-09-15T04:52:52.716Z","dependency_job_id":null,"html_url":"https://github.com/0xSobky/XSSBuster","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xSobky%2FXSSBuster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xSobky%2FXSSBuster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xSobky%2FXSSBuster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xSobky%2FXSSBuster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xSobky","download_url":"https://codeload.github.com/0xSobky/XSSBuster/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253831017,"owners_count":21971009,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dom-xss","injection-attacks","web-security","xss","xss-filter"],"created_at":"2024-11-09T14:06:44.808Z","updated_at":"2025-05-12T22:18:04.574Z","avatar_url":"https://github.com/0xSobky.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# XSSBuster\n**XSSB** is a proactive DOM sanitizer, defending against client-side injection attacks.\n\n# The Problem:\nWith every unaudited third-party JS library you include into your DOM, the risk of accidental DOM-based cross-site-scripting issues rises linearly. It being for advertisement, web analytics, social widgets, et al., all sorts of third-party code is susceptible to injection attacks.\n\nExamples of this are:\n* [http://www.troyhunt.com/2015/07/how-i-got-xssd-by-my-ad-network.html](http://www.troyhunt.com/2015/07/how-i-got-xssd-by-my-ad-network.html)\n* [https://blogs.dropbox.com/tech/2015/09/csp-the-unexpected-eval/](https://blogs.dropbox.com/tech/2015/09/csp-the-unexpected-eval)\n* [http://www.fuzzysecurity.com/tutorials/14.html](http://www.fuzzysecurity.com/tutorials/14.html)\n* [http://blog.mindedsecurity.com/2011/04/god-save-omniture-quine.html](http://blog.mindedsecurity.com/2011/04/god-save-omniture-quine.html)\n* [https://hackerone.com/reports/125386#activity-888336](https://hackerone.com/reports/125386#activity-888336)\n\n# The Solution:\n**XSSB** mainly utilizes [taint checking](https://en.wikipedia.org/wiki/Taint_checking) to guard against accidental mistakes and poor security practices commonly employed by JS libraries that may lead to DOM-based XSS vulnerabilities.\n\nA rough idea of how it works is: Data from untrusted input sources such as `window.name`, `location.hash`, `document.referrer`, `window.onmessage`, et al. are tainted and are constantly tracked for any changes. **XSSB** then overrides security-sensitive functions and DOM APIs (e.g., `eval()`, `document.write()`, `Element.prototype.appendChild()`, etc.) to enforce taint checking and prevent insecure operations such as `eval(location.hash.slice(1))`, `document.write(window.name)`, and the like.\n\nSo, basically, **XSSB** offers you the freedom to deploy any given third-party code into your DOM while at the same time covering your DOM's back!\n\n# Usage Instructions:\nSimply place the script element of _XSSBuster.js_ right before any other third-party scripts you include into your webpage(s), typically at the very top of the head tag:\n```html\n\u003chead\u003e\n    \u003ctitle\u003eExample\u003c/title\u003e\n    \u003cscript type=\"text/javascript\" src=\"XSSBuster.js\"\u003e\u003c/script\u003e\n    \u003cscript type=\"text/javascript\" src=\"thirdParty-library.js\"\u003e\u003c/script\u003e\n\u003c/head\u003e\n```\n#### Notes:\n* Make sure to host _XSSBuster.js_ on the same origin as the hosting webpage or use the _\"X-XSS-Protection: 0\"_ HTTP header to guard against the potential abuse of browsers' integrated XSS auditors.\n* For the minified version, see [_XSSB-min.js_](/src/XSSB-min.js).\n\n# Demo:\nA live demo can be found at: [https://xssb.herokuapp.com](https://xssb.herokuapp.com).\n\n# Performance:\n\nBased on tests, **XSSB** only takes [10 milliseconds on average](/perf/perf.html) to do all required security checks besides the registration of a few necessary event listeners.\n\n# Compatibility:\n**XSSB** is compatible with the latest versions of all major web browsers (Firefox, Chrome, IE, Edge, Safari, and Opera) as well as most legacy web browsers through fallback functionality.\n\n# Known Issues:\n* **XSSB** only allows for [Basic Latin](https://en.wikipedia.org/wiki/Basic_Latin_(Unicode_block)) characters within the pathname, search query and hash of the hosting webpage's URL; that somewhat also applies to HTML5 messaging.... If your web application deals with a different set of characters, you may consider [base64](https://en.wikipedia.org/wiki/Base64) encoding as a workaround.\n* **XSSB** overrides security-sensitive functions like `eval` in order to enforce taint checking. A side effect of this is that `eval` will behave more like jQuery's [`globalEval`](https://api.jquery.com/jquery.globaleval/) than the native implementation of `eval` in most web browsers.\n\n# Credits:\n* [@0xSobky](https://twitter.com/0xsobky)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xsobky%2Fxssbuster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xsobky%2Fxssbuster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xsobky%2Fxssbuster/lists"}