Secure source code review tool for jQuery

Question

Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.

Answer 1

Very few vulnerabilities exist in client side code when compared to other components in a modern web application. Even if you have a very obvious CWE-602 violation the vulnerability exists because of a lack of server-side controls. No tool that I am aware of can detect CWE-602 violations.

That being said the client isn't totally exempt from vulnerabilities. The two biggest problems being mixed content vulnerabilities and dom based xss. Domsnitch is one of the few tools that is able to detect both of these, although it also produces a large number of false positives.

There are also commercial tools that perform static code analysis of JavaScript for the purpose of finding vulnerabilities. HP Fortify and IBM's AppScan are examples of this type of software.

Answer 2

There is a way of securing Ajax Calls with :

jQuery Deferred Objects Promise Callbacks

And create a global function and use it with the deferred Object.

But on Jquery Support they say there is no way how to hide or secure Jquery(js) Code

Its the client side they can do what ever they wants to!

My advise : is to use unormale short and not descriptive variable when using ajax or even in any func

Just do it in Facebook Way do they send /like.php?_a=1 for a like in ajax and _a=0 for a dislike

Answer 3

I don't know of a good security code review tool that focuses on jQuery.

For plain Javascript, Douglas Crockford's JavaScript: The Good Parts + JSLint is an excellent tool that will help you avoid many bugs in your code, possibly including security bugs.

If possible, I recommend setting a restrictive Content Security Policy (CSP) and writing your Javascript to comply with the CSP. This will probably be most feasible for new code, but it may not be feasible if you already have a large amount of existing code.

In particular, I recommend setting a CSP that bans eval and eval-like constructs (as these are commonly misused and often lead to security vulnerabilities). Also, if it is feasible without too much cost to you, ban inline Javascript and Javascript loaded over HTTP; put all script in a separate file, which is loaded over HTTPS via a script src=... tag. The benefit of CSP is that it will help you enforce some aspects of a coding discipline that is beneficial for security. See, e.g., how Twitter is using CSP and how Google Chrome extensions are using CSP.