Does anyone know any secure source code review tool for jQuery/jQueryUI. I've looked around a bit but couldn't find anything. Its too good if it is opensource.
Very few vulnerabilities exist in client side code when compared to other components in a modern web application. Even if you have a very obvious CWE-602 violation the vulnerability exists because of a lack of server-side controls. No tool that I am aware of can detect CWE-602 violations.
That being said the client isn't totally exempt from vulnerabilities. The two biggest problems being mixed content vulnerabilities and dom based xss. Domsnitch is one of the few tools that is able to detect both of these, although it also produces a large number of false positives.
I don't know of a good security code review tool that focuses on jQuery.
In particular, I recommend setting a CSP that bans
script src=... tag. The benefit of CSP is that it will help you enforce some aspects of a coding discipline that is beneficial for security. See, e.g., how Twitter is using CSP and how Google Chrome extensions are using CSP.
There is a way of securing Ajax Calls with :
And create a global function and use it with the deferred Object.
But on Jquery Support they say there is no way how to hide or secure Jquery(js) Code
Its the client side they can do what ever they wants to!
My advise : is to use unormale short and not descriptive variable when using ajax or even in any func
Just do it in Facebook Way do they send /like.php?_a=1 for a like in ajax and _a=0 for a dislike