CSP, XSS, WTF?

Special discount for this talk, you will learn about two related stories for the price of one!
The first one is about how the Jenkins Security team is including Content Security Policy (CSP) in the Jenkins project without breaking everything. We will explain why CSP is appealing in terms of security and how we are envisioning its introduction in an existing (very large) project.
The second part of the talk will be on a Cross-site scripting (XSS) vulnerability we have found on a very popular dating application. This vulnerability was particularly interesting as it had the possibility to spread like a virus within the social network and the impact could have been catastrophic. We will explain how we were able to bypass their incomplete CSP configuration.