CSP Directive for Eliminating DOM Clobbering

DOM clobbering is a Web vulnerability where an attacker capable of injecting non-executable HTML markup with specially crafted `name` and `id` attributes in a webpage, can effectively overshadow benign JavaScript (JS) objects’ properties. Thus, the attacker can alter the execution flow of the existing, benign JS codebase, potentially escalating their attack to severe variations, such as XSS and CSRF. Despite DOM clobbering being a known issue for well over a decade, no defense mechanisms have been proposed to completely eradicate the issue. This project will address this gap by designing and creating a reference implementation of a new Content Security Policy (CSP) directive for Chromium-based browsers, namely `block-named-access`, that websites can trivially deploy to robustly eliminate all instances of potential DOM clobbering vulnerabilities in their pages. Essentially, the directive will serve as an opt out switch for the “named property accesses” feature of the HTML specification, which is the root cause of DOM clobbering. Importantly, `block-named-access` will also support CSP’s `report-only` mode, where violations are reported to website operators without enforcing any protection, ensuring page functionality remains intact. This will enable a smooth transition for adopting websites, by initially rolling out the directive in report-only mode, identifying and refactoring any intentional usage of the HTML named access feature and, finally, deploying the directive in full enforcement to prevent and report any exploitation attempts.