XSS on GMO Flatt Security Research

Why XSS Persists in This Frameworks Era?

Tue, 08 Jul 2025 00:00:00 +0000

Introduction

Hi, I’m canalun (@i_am_canalun ), a security researcher at GMO Flatt Security Inc.

This article explores the question: “Why Does XSS Still Occur So Frequently?” We will delve into why this notorious and classic vulnerability despite the widespread adoption of built-in XSS countermeasures in modern development frameworks.

The world of web development, especially frameworks, is evolving at a rapid pace, bringing improvements not only in development efficiency but also in security.

Bypassing DOMPurify with good old XML

Mon, 01 Apr 2024 00:00:00 +0000

Introduction

Hello, I’m RyotaK ( @ryotkak ), a security engineer at Flatt Security Inc.

Recently, @slonser_ found a bypass in the DOMPurify when it’s used to sanitize XML documents. After taking a look at the patch, I found two more bypasses of XML/HTML confusion, so I’m documenting it here.

HTML != XML

As @slonser_ wrote in his post, HTML and XML have a bit different parsing rules.
For example, the following text is parsed as a single node in the XML parser, but the HTML parser recognizes the h1 tag.