A much better way to mitigate XSS/HTML injections is not using string functions to generate HTML.
CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.
CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.
It's like what ASLR and stack canaries do for buffer overflow vulnerabilities in C/C++. You still should try to avoid writing buffer overflow bugs, but if/when they do happen, the protections mean that the issue will probably just be a denial-of-service issue rather than an issue that lets an attacker execute code on your systems.
APIs like jQuery are worse because you end up treating strings as HTML without even realizing it. Example from the article:
$("#tail-here").prepend(newlines);
content
Type: >>htmlString<< or Element or Array or jQuery
The only native DOM API calls that can get you an XSS vulnerability are sets to `innerHTML`, `outerHTML`, and maybe some few others. Most of the methods for getting things done don't have any possibility of introducing an XSS issue. With jQuery, many methods including every method capable of inserting elements is also capable of introducing an XSS issue depending on the types passed to them. So you when you're reviewing for XSS issues, you have many more places to check, and analyzing the calls to jQuery methods to see if they have the potential for XSS is much more difficult because you have to trace the path backwards from every single call to see what types are set into the variables passed to the methods.
That is exactly what I’m arguing, yes.
> but it's not really surprising that a function does what it is documented to do
It doesn’t have to be surprising or undocumented to be stupid.
> You could argue that the API is bad for allowing HTML strings as arguments
That is exactly what I’m arguing, yes.
jQuery has text()[0], but because most of its API takes strings to start with, it's very convenient to do the wrong thing and shove untrusted strings into unsafe methods.
jQuery calls unsafe API which should only be handled trusted strings but makes it easy and convenient to give them untrusted string and thus introduce exploit vectors.
Furthermore it's also significantly more difficult to audit the code, using the regular DOM there are only a pair of attributes to check, whereas pretty much any jQuery method call is a potential security hole.
tldr: jQuery makes doing things wrong very easy, much easier than doing things right.