Can someone recommend a secure coding guideline for JavaScript?

Is there a set of common vulnerabilities that are closely related to the JavaScript programming language? What I am searching for are equivalent vulnerabilities to stack, heap or buffer overflows which are closely related to the c/c++ programming language.

Can one recommend tools for static code analysis tools within the JavaScript context?

  • 3
    Don't eval user input (goes for every language with eval). Don't use the Function constructor (same reason). Most other web vulnerabilities (e.g. XSS, SQL injection) are not problems with JavaScript code per se. Any linter worth it's salt (JSLint, JSHint, ESLint) will warn you of potentially problematic code (e.g. eval). – Jared Smith Mar 28 '18 at 15:02
  • This thread over at Stack Overflow may have the answers you're looking for. – user171922 Mar 28 '18 at 20:07
  • js doesn't really have vulnerabilities (though other areas of the browser reachable by JS might, example flash) and when something with core does popup, like timing attacks, it gets rapidly fixed. In short there's not a lot to scan for; it's all about how the code is used/abused, principally social engineering. – dandavis Mar 28 '18 at 23:51
  • 1
    @dandavis What are you talking about? Look at any recent MSFA. The majority of them are related to JavaScript. Some are exclusively issues with the JS engine, while others "merely" rely on JavaScript to access the interfaces (e.g. WebGL bugs). – forest Mar 29 '18 at 0:35
  • @forest: well, looking at mozilla.org/en-US/security/advisories, the last js vuln i see is from 2015: 2015-29. in fact on the whole page, there's only a few JS vulns, ever. Maybe i'm missing something, can you link a recent core vuln (not a crash) or two? core bugs in a basically 20-year old spec would be surprising; there's simply not that much in JS to go wrong (~30 keywords). – dandavis Mar 29 '18 at 1:54

Full disclosure: the following guide was written by the research team of Checkmarx, creator of CxSAST (static code analysis tool), where I am employed.

Here is a JavaScript Secure Coding Practices guide:

Since JavaScript is used these days both in front and back ends of applications, a plethora of vulnerabilities and issues are relevant and important to know while developing in JavaScript:

  • Cross Site Scripting (XSS) - Reflected, Stored and DOM based.
  • SQL and NoSQL injections
  • Authentication and password management issues
  • Session management issues
  • Access control issues
  • Unsafe use of cryptography - Hashing, Encryption, Decryption and Random number generators
  • Error Handling and Logging issues

To name a few... :)

  • 2
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review – Josef says Reinstate Monica Mar 29 '18 at 11:03
  • You are right. I will add an outline. – yaloner Mar 29 '18 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.