security-review-owasp-dom-clobbering-prevention

Review HTML sanitization for DOM clobbering by checking whether injected markup properly filters dangerous id and name attributes that can collide with browser globals. This process flags unsafe window or document property reads and verifies library protections.

DOM clobbering is an attack where user-controlled HTML alters browser behavior via named-property collisions. You need to check for it during security audits of rich-text rendering flows, client-side routers, or callback lookup paths where DOM naming can influence security-critical logic.

Find unsafe global property reads by reviewing code for implicit globals and direct window or document access that attacker-controlled markup could clobber. The review separates confirmed weaknesses from evidence gaps and produces findings with concrete code-path references.

Yes, the security review explicitly distinguishes between confirmed DOM clobbering issues and gaps in evidence. It requires evidence-backed findings with concrete code-path or behavior references to ensure review discipline and accurate security auditing.

Yes, you can audit client-side routers and callback lookup paths for DOM clobbering risks. The review checks whether DOM naming collisions can influence security-critical logic by evaluating global scoping, type validation, and sanitization controls.

HTML sanitization limitations arise when dangerous id and name attributes are not properly filtered, allowing named-property collisions to clobber browser globals. The review identifies these gaps by checking global scoping, type validation, and library protection mechanisms.