I'm making my own client-side router which dynamically requests html pages from Firebase hosting, and the website uses Cloud Firestore with secure rules. Is there any XSS HTML event js injection danger like so:

<button onClick = "alert('Some harmful stuff is happening')">Click me!</button>

If I implement a client-side sanitizer, and is there any danger in general even if I don't sanitize incoming pages since all requests are same origin?

  • 1
    Hard to say without a complete analysis of your environment. – Robert Harvey Jul 17 '20 at 22:40
  • What data more specifically would you want me to add? – AsyncBanana Jul 17 '20 at 23:15
  • It's not that simple. It "works" if Cloud Firestore secure rules and the client-side sanitizer says it "works" (for some definition of "works"). Are you going to trust them? – Robert Harvey Jul 18 '20 at 0:01
  • To put your question in perspective, this is what OWASP says is needed to have reasonable confidence that your site is "secure" (for their definition of "secure"). – Robert Harvey Jul 18 '20 at 0:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.