Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
-
1Do you mean server side, or client-side?– Andrew SmithCommented Aug 21, 2012 at 16:44
-
1jQuery runs on the client, so I imagine it's client side. The server side stuff would be better tested with a normal battery of tests (SQLi, XSS, CSRF, etc).– PolynomialCommented Aug 21, 2012 at 18:08
-
1@Andrew Smith Although you can run JS on the server with node.js or mongodb, jQuery's biggest power is in controlling user interfaces and wouldn't be a very useful server-side library.– rookCommented Aug 21, 2012 at 18:19
Add a comment
|
3 Answers
Very few vulnerabilities exist in client side code when compared to other components in a modern web application. Even if you have a very obvious CWE-602 violation the vulnerability exists because of a lack of server-side controls. No tool that I am aware of can detect CWE-602 violations.
That being said the client isn't totally exempt from vulnerabilities. The two biggest problems being mixed content vulnerabilities and dom based xss. Domsnitch is one of the few tools that is able to detect both of these, although it also produces a large number of false positives.
There are also commercial tools that perform static code analysis of JavaScript for the purpose of finding vulnerabilities. HP Fortify and IBM's AppScan are examples of this type of software.
-
Vulnerabilities in client-side code are common. Common examples include code injection (e.g., misuse of
eval) and client-side XSS (aka DOM-based XSS).– D.W.Commented Aug 21, 2012 at 18:42 -
@D.W. So clearly my post is entirely incorrect and therefore requires a downvote.– rookCommented Aug 21, 2012 at 18:50
-
Sorry that this seems to have upset you! I thought you might like a comment so you can edit your answer to improve it (e.g., by correcting the claim if you agree with my critique, or justifying it if you stand by your statement).– D.W.Commented Aug 21, 2012 at 18:54
-
+1: Lotsa good resources here. I like the revision; thanks! (Hate to pick on you more, but a nitpick: I'm not persuaded that there are very few vulnerabilities in client-side code. You may have more experience with web pentesting than I do, but the data I've seen indicates that client-side vulnerabilities are by no means rare. I would expect this to vary from site to site, depending upon how much they use client-side code, but for a site with rich client-side functionality, I would not discount the potential for client-side vulnerabilities.)– D.W.Commented Aug 21, 2012 at 20:24
I don't know of a good security code review tool that focuses on jQuery.
For plain Javascript, Douglas Crockford's JavaScript: The Good Parts + JSLint is an excellent tool that will help you avoid many bugs in your code, possibly including security bugs.
If possible, I recommend setting a restrictive Content Security Policy (CSP) and writing your Javascript to comply with the CSP. This will probably be most feasible for new code, but it may not be feasible if you already have a large amount of existing code.
In particular, I recommend setting a CSP that bans eval and eval-like constructs (as these are commonly misused and often lead to security vulnerabilities). Also, if it is feasible without too much cost to you, ban inline Javascript and Javascript loaded over HTTP; put all script in a separate file, which is loaded over HTTPS via a script src=... tag. The benefit of CSP is that it will help you enforce some aspects of a coding discipline that is beneficial for security. See, e.g., how Twitter is using CSP and how Google Chrome extensions are using CSP.
There is a way of securing Ajax Calls with :
jQuery Deferred Objects Promise Callbacks
And create a global function and use it with the deferred Object.
But on Jquery Support they say there is no way how to hide or secure Jquery(js) Code
Its the client side they can do what ever they wants to!
My advise : is to use unormale short and not descriptive variable when using ajax or even in any func
Just do it in Facebook Way do they send /like.php?_a=1 for a like in ajax and _a=0 for a dislike
