document: Regular expressions considered harmful in client-side XSS filters Cross-site scripting flaws have now surpassed buffer overflows as the world 's most common publicly-reported security vulnerability . In recent years , browser vendors and researchers have tried to develop client-side filters to mitigate these attacks . We analyze the best existing filters and find them to be either unacceptably slow or easily circumvented . Worse , some of these filters could introduce vulnerabilities into sites that were previously bug-free . We propose a new filter design that achieves both high performance and high precision by blocking scripts after HTML parsing but before execution . Compared to previous approaches , our approach is faster , protects against more vulnerabilities , and is harder for attackers to abuse . We have contributed an implementation of our filter design to the WebKit open source rendering engine , and the filter is now enabled by default in the Google Chrome browser .
doc_bio_tags: O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O B O