Lion Cipher Lab
Defend a web app against DOM clobbering
- AppSec / DevSecOps
- Advanced
- ~45 min
- Free · no account required
Why it matters
Teams ship a strict Content Security Policy, watch script-src block classic cross-site scripting, and conclude the client is safe. It is not. DOM clobbering injects only benign markup — plain id and name attributes on ordinary tags — and no script ever runs, so script-src is irrelevant. Yet those attributes can overwrite the global variables and object properties your JavaScript reads, silently redirecting a fetch, disabling a check, or even breaking the sanitizer that was supposed to protect you. If your mental model of client-side risk stops at 'no XSS because CSP,' this is the gap an…
What you'll learn
- DOM clobbering
- browser named-access model
- client-side threat modeling
- clobbering-aware HTML sanitization
- DOMPurify configuration
- why CSP script-src is not the whole story
Steps in this lab
- The three words you need first: DOM, global object, named access
- Build a tiny, safe target on your own machine
- See a single element become a global — the core mechanic
- Clobber a nested property: the id + name HTMLCollection trick
- Why a strict CSP does not stop this
- Defenses that feel right but fail
- Fix #1 — don't let security-relevant values live on window/document
- Fix #2 — sanitize untrusted markup with a clobbering-aware sanitizer (DOMPurify)
- Named failure modes — how the fix gets un-fixed
- The judgment to carry out of here