René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Low][security] DOM-clobbering protection is a small denylist; generic id/name clobbering passes","articleBody":"## Severity: 🟢 Low (defense-in-depth; weak denylist)\n\n## Location\n[`src/security/constants.ts:132-169`](../blob/main/src/security/constants.ts#L132-L169) (`RESERVED_IDS`), applied at [`src/security/sanitize-core.ts:286`](../blob/main/src/security/sanitize-core.ts#L286).\n\n## Description\nDOM-clobbering protection only strips `id`/`name` values whose exact (trimmed, lowercased) value is in a ~30-entry reserved list. Generic clobbering passes: `\u003ca id=\"myCustomGlobal\"\u003e` and the classic `\u003ca id=x\u003e\u003c/a\u003e\u003ca id=x name=y\u003e\u003c/a\u003e` HTMLCollection-clobbering vector survive unchanged. The list is also incomplete (`attributes`, `nodeName`, `getElementById`, `defaultView`, `implementation`, … are absent). Any app that reads `window.\u003cid\u003e`, `document.\u003cname\u003e`, or uses named form controls remains clobberable.\n\n## Suggested fix\nTreat this as defense-in-depth and document it as such. Consider optionally namespacing/prefixing untrusted `id`/`name`, or dropping them entirely on untrusted content; at minimum expand the list and reject duplicate ids within a sanitized fragment.\n\n---\n_Filed as part of a full-codebase security \u0026 correctness audit._\n","author":{"url":"https://github.com/JosunLP","@type":"Person","name":"JosunLP"},"datePublished":"2026-07-05T17:03:50.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/179/bQuery/issues/179"}