Proposal: Add Trusted Types API to Mitigate XSS Vulnerabilities about asvs

[tghosth]

I like the concept but I agree with Elar that this is out of scope for ASVS.

However, I think this might actually be a valid use of a top 10 project, the OWASP Top 10 emerging application security mechanisms or something. I don't usually like top 10s but since this is specifically for awareness, it might be a good fit :)

[tghosth]

Ok, so my big problem with trusted types is that it is quite complicated to implement (especially retroactively) and it is only supported by Chromium and Opera but not Firefox and Safari.
https://caniuse.com/trusted-types

Santizer API seems like a more widely adopted process but it is still at the discussion stage (https://wicg.github.io/sanitizer-api/) and things are changing so much that Chromium has actually removed support from it until the API becomes more stable.
https://caniuse.com/?search=sanitizer

It is also solving a slightly different problem to trusted types.

In conclusion, I think that disappointingly these mechanisms are not mature enough to include in ASVS.

@jmanico what do you think?

[jmanico]

I'm torn on this. Developers will mostly benefit from this being built into frameworks. But it's also a very high end defense that is quite powerful. I tend to say yes, but can accept a no. I worry ASVS is getting too bulky.

[elarlang]

So, yes it is useful, but...

First the thing what @tghosth already pointed out, that it lacks browser support at the moment.

Second - can / do we need to require it? The point is, you can write your code secure against so-called DOM XSS without using it.

Feels more something to be recommended, not required. Happy to change my mind with arguments why it should be required.

[ImanSharaf]

@tghosth I believe that ASVS could still play a pivotal role in advocating for future-ready security measures. While Trusted Types and Sanitizer API are not widely adopted yet, their potential in enhancing web application security is considerable.

Suggested Approach

• Future Guidance: Perhaps ASVS could include a section on emerging security technologies like Trusted Types and Sanitizer API. This would not be a requirement but rather guidance for the future, helping organizations prepare for and gradually adopt these technologies as they mature and gain wider support.
• Awareness and Advocacy: By mentioning these technologies, ASVS can raise awareness and potentially influence broader adoption and faster maturity, as organizations and developers start considering and experimenting with these APIs.
• Differentiation of Standards: Clearly differentiate between current best practices and emerging technologies. This ensures that the ASVS remains practical and relevant, while also being forward-looking.

[elarlang]

For me it feels cheat sheet material. ASVS is not an awareness project, there is top10 and cheat sheet projects for that.

As this discussion and quite different point of view what and why is ASVS is relatively frequent lately, we need to write it out somewhere.