From the OWASP cheat sheet on preventing DOM-based XSS, Guideline #8 reads the following:

Limit access to properties objects when using object[x] accessors (Mike Samuel). In other words use a level of indirection between untrusted input and specified object properties.

Here is an example of the problem when using map types:

var myMapType = {};
myMapType[<%=untrustedData%>] = "moreUntrustedData";

Although the developer writing the code above was trying to add additional keyed elements to the myMapType object. This could be used by an attacker to subvert internal and external attributes of the myMapType object.

My application receives data keys through AJAX requests to build the client-side data structures. Is this data something I should worry about given this guideline?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.