David Klein

General Data Protection Runtime: Enforcing Transparent GDPR Compliance for Existing Applications

2023

Recent advances in data protection regulations brings privacy benefits for website users, but also comes at a cost for operators. Retrofitting the privacy requirements of laws such as the General Data Protection Regulation (GDPR) onto …

Parse Me, Baby, One More Time: Bypassing HTML Sanitizer via Parsing Differentials

2024

Websites rely on server-side HTML sanitization to defend against the ever-present threat of cross-site scripting attacks. Parsing arbitrary pieces of markup to assess whether they contain an exploit payload is far from trivial. This complexity …