Questions tagged [javascript]
The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
1,354
questions
3
votes
2
answers
451
views
Securing a Node.js REST API for React.js webapp as well as a standalone API
I'm trying to create a secure method of authentication for my Node.js REST API that will work both for direct API requests as well as from my React.js web application. I've done some reading on how to ...
CommunityBot
- 1
1
vote
2
answers
293
views
When receiving PDFs from unknown sources, is it sufficient to remove dynamic content to minimise attack surface?
My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients. While the image formats are ...
CommunityBot
- 1
0
votes
1
answer
1k
views
Secure authentication on SPA/Javascript application with “remember me” support
I have 3 website projects as follows;
identity.example.com (asp.netcore + IdentityServer4)
api.example.com (asp.netcore webapi)
www.example.com (asp.netcore + aurelia)
I am able to authenticate the ...
CommunityBot
- 1
0
votes
0
answers
4
views
Hooking WASM Functions On Web Page [migrated]
Is there a way to hook a function inside a WebAssembly running on a web page? Usually Frida works for standalone application, but I have no idea how to do it on WebAssembly.
- 129k
5
votes
1
answer
840
views
What are the reasons for CORS failure errors to not be available to JS?
From Cross-Origin Resource Sharing (CORS) - HTTP | MDN:
CORS failures result in errors but for security reasons, specifics about the error are not available to JavaScript. All the code knows is that ...
- 5,907
2
votes
3
answers
484
views
About vulnerability in the dependency
I have read many articles about the vulnerability in the program dependency, either direct or transitive.
Here are two questions come out of my mind.
If a dependency A has a vulnerability (Maybe has ...
- 12.4k
0
votes
1
answer
173
views
Is <img :src="require`${JSON.parse(string)}`"> in electron vue is safe from XSS?
I am inspecting a client's application written with Vue.js and I found there a following construction.
// Somewhere else in the code
var data = JSON.parse(jsonString);
// In the vue component
<...
CommunityBot
- 1
2
votes
3
answers
729
views
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
If not then is there any way to visit a malicious ...
CommunityBot
- 1
0
votes
1
answer
61
views
how to send cookies or token in local storage to a remote server using reflected XSS
I have an XSS vulnerability identified by <script>alert(1);</script> in the url.
So when I put it in the url it gets executed (ex: www.example.com/admin/<script>alert(1);</script&...
- 48.4k
2
votes
1
answer
123
views
Secure way to output encoding HTML for insert raw html via javascript
I want to be 100% secure, I create raw html this way:
const template = document.createElement('template')
template.innerHTML = html_raw
const cloned = template.content.cloneNode(true)
document....
- 41
1
vote
1
answer
147
views
Is this a type of XSS attack?
I have been exploring customer support in a website as part of bug bounty program.
I then started a chat with their customer support and pasted the following in the box:
<!--<img src="-->...
CommunityBot
- 1
0
votes
2
answers
146
views
Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?
When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
CommunityBot
- 1
0
votes
1
answer
338
views
Dom Clobbering methods on the document object
I'm struggling to understand how this flavor of dom clobbering actually works.
The green box at the top of this section of the HTML spec makes it pretty clear why I can access HTML elements as global ...
CommunityBot
- 1
3
votes
1
answer
5k
views
Security risks with setDomStorageEnabled(true) in Android?
What are the security risks associated with enabling setDomStorageEnabled(true) method?
Reference.
CommunityBot
- 1
3
votes
2
answers
1k
views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
CommunityBot
- 1
43
votes
3
answers
33k
views
Why is there no web client for Signal?
I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure.
...
- 220
1
vote
1
answer
4k
views
Demonstrating reflected XSS with GET Parameter and URL encoding
A client is developing a website which is vulnerable to reflected XSS through a GET parameter:
https://example.com/vulnerable-url?")||true)alert("XSS");</script>
I would like to demonstrate ...
CommunityBot
- 1
2
votes
1
answer
375
views
Is it possible to get a flash src after a redirect or an element inside an embed/object/iframe tag (cross-domain)?
The URL example.com/auth will automatically redirect the user (HTTP 302) to example.com/signed_in.SWF?token=SENSITIVE.
Is it possible for an attacker to steal the token, using javascript or flash, in ...
CommunityBot
- 1
2
votes
1
answer
505
views
Website with embedded PDFs and JavaScript for Acrobat
Context
On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files.
I was wondering if this could come with security issues.
The uploaded PDF are ...
CommunityBot
- 1
0
votes
0
answers
111
views
Lax SameSite and POST (2 minute)
I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
- 129k
0
votes
1
answer
119
views
is <script>javascript:alert(document.domain); a valid script for xss?
I have submit the following text <script>javascript:alert(document.domain); in a feedback of a restaurant listed on a website and feedback is sent to website not restaurant.
I want to verify but ...
- 129k
2
votes
1
answer
135
views
Securely storing derived key in web app and handling user identity
I am currently working on an open source project to securely store notes, payment card numbers, etc. I would like to implement a zero knowledge encryption method so that no one but the user can ...
2
votes
1
answer
218
views
What are the security considerations for coding a website with interactive scripts but no backend?
I am developing a simple grammar study website with Bootstrap 5, JQuery and Javascript. It will have interactive grammar quizzes and flashcards. I would like users to be able to type in answers to ...
CommunityBot
- 1
2
votes
1
answer
3k
views
Securing a JavaScript Single Page App with SAML
I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options?
Details: I have worked with OAuth2 in the past, but I ...
CommunityBot
- 1
0
votes
2
answers
306
views
derived key from email + password?
When deriving a private key from a password, will the resulting secret key be any weaker if the user email is included in the function input? Meaning, user email concatenated with the user password.
...
CommunityBot
- 1
1
vote
1
answer
1k
views
Can javascript from parent page read url of popup window?
Lets say I'll open a third party page from the parent page using window.open(popup method)
Now what I want to know is there any way where the parent page(using javascript or any third party library) ...
CommunityBot
- 1
3
votes
2
answers
1k
views
How can user send malware code via input=file
After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
CommunityBot
- 1
2
votes
1
answer
250
views
DBus proxy Javascript binding issues
Gnome 3 (under GNU/Linux, BSD or other Un*x) now offers a gnome shell with nice presentation, but where the configuration and theming are to be done via a web browser (and a public URL, on a public ...
CommunityBot
- 1
1
vote
3
answers
732
views
JS challenge based on computational complexity
Assuming I have a website with a button that sends AJAX requests to my server which will be expensive to process.
I suppose that mostly cookie or JavaScript + cookie challenges are used to prevent (...
CommunityBot
- 1
1
vote
2
answers
828
views
XSS against jQuery PortSwigger challenge
I am trying to do this jQuery XSS challenge here by PortSwigger.
They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
CommunityBot
- 1
0
votes
1
answer
105
views
Certificate structure for accessing a local device from a web app
I have a pretty standard web app (react client, node server), https-enabled.
I want to add the ability for the web app to access a device on the local LAN. The device has REST APIs and I can install ...
CommunityBot
- 1
5
votes
1
answer
290
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
CommunityBot
- 1
1
vote
1
answer
194
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
CommunityBot
- 1
0
votes
1
answer
2k
views
Is it html escape enough for mitigating all xss, if html is going to be generated only in client side?
If all html in a site is generated in client side (attributes, urls, styles everything will be concatenated in javascript and set as innerHTML), is it doing only html escape enough for mitigating all ...
- 1,777
1
vote
1
answer
87
views
Is it safe to store the OIDC token in a private field of a javascript object?
I would like to initialise a React application with an OIDC token.
This token will be stored in a private field of the "api client" object. This object will be used to execute API calls and ...
CommunityBot
- 1
1
vote
0
answers
81
views
Can an embedded 3rd party JS script access or keystroke log an iFrame's content
Say there is a web page with two 3rd party javascript URL scripts embedded in it. One creates a support chat window and the other creates an iFrame within which a user enters payment information into ...
- 111
0
votes
1
answer
7k
views
Where to store JWT refresh tokens
Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
CommunityBot
- 1
9
votes
3
answers
2k
views
What happens if my anti-CSRF token is compromised by an XSS attack?
The interesting Stack Overflow question "Do cookies protect tokens against XSS attacks?" was closed as too broad, but as mentioned in a comment on it, there is a tangible question of "What happens if ...
- 48.4k
0
votes
0
answers
62
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.6k
1
vote
2
answers
208
views
How to mitigate risk of exploiting open POST endpoints?
I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.).
I'm owning a web application that exposes some HTTP endpoints to the world. ...
CommunityBot
- 1
0
votes
0
answers
63
views
Methods to look for when checking if a javascript program is making network requests
I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following:
XMLHttpRequest
fetch
$.ajax
axios....
- 129k
0
votes
0
answers
101
views
unsafe-hashes an alternatives
I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine.
<script th:inline="javascript">
/*<
- 101
2
votes
1
answer
543
views
Is JSON vulnerability still possible?
I have a bunch of REST APIs which would be consumed by frontend applications created by customers using our product. I have suggested to only use last 2 versions of Chrome for running frontend apps. ...
- 121
0
votes
0
answers
134
views
How to abuse the onerror method to get XSS?
In the book Javascript for hackers, Gareth Heyes overwrites the window.onerror method with eval, used to execute a function.
From my understanding, the following snippet run in a browser console ...
- 133
1
vote
1
answer
145
views
Timing Attack using bcrypt.js
I am using bcrypt.js for basic login. I have found that the below code runs noticeably quicker when no user is found, since it exits immediately, and no check is done on the hash. This could give an ...
- 201k
0
votes
0
answers
185
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
0
votes
0
answers
124
views
What's an example of a good uninjection in Node.js? (mySQL)
I'm hosting a simple MariaDB/mySQL server on my Raspberry Pi. I would like to know whether or not this code is secure enough to reject an injection attempt made by login/signup, etc.
function ...
- 279
15
votes
5
answers
5k
views
HTTP Content-Security-Policy Nonce and Caching
Is anyone here able to clarify how caching affects adding a nonce=value to all inline javascript?
If the nonce must be unique and unpredictable, then one would need to disable all server-side (i.e. ...
0
votes
0
answers
98
views
Safe Sinks js confusion
Have some confusion regarding safe sinks in javascript.
The DOMpurify library linked in the OWASP article does not explicitly mention the .files and .valueAsDate of an HTMLInputElement as safe sinks, ...
- 101
-1
votes
3
answers
8k
views
Can a URL contain executable JavaScript?
I am learning about "Session fixation" and have read the corresponding OWASP page.
In their Example 2 in the above page, they describe an attack via JavaScript, that is embedded in the URL like:
...
