2

I am developing a simple grammar study website with Bootstrap 5, JQuery and Javascript. It will have interactive grammar quizzes and flashcards. I would like users to be able to type in answers to grammar questions and upload their own vocabulary sets via CSV files. There will be no logins, no back-end and no data persistence: everything will run in the browser. No uploaded data will survive a refresh. I would like to ultimately host it as a static site with a cloud PaaS provider.

I figure server hardening (HTTPS, DDoS, headers, etc...) will be handled by the cloud host. I want to follow every security best practice and button-up every potential hole in the code, though. What are the actual risks with a semi-static site like this, particularly regarding user input?

Thank you!

Improve this question
6
  • If there's no "backend", where are they uploading the csv file too?
    – Blake
    Jul 26, 2021 at 18:30
  • 1
    Good question! The data from the file just gets read into a variable in the Javascript. Technically, it's not really uploading the file I suppose as much as reading the data from a file on the source computer into the browser.
    – SprocketTheSpaceDuck
    Jul 26, 2021 at 18:56
  • 1
    WRT, 'There will be no logins, no back-end and no data persistence: everything will run in the browser. No uploaded data will survive a refresh.' - is this a single page application (SPA)? If so, does the SPA interact with a server through XHR (or AJAX) calls?
    – mti2935
    Jul 26, 2021 at 18:57
  • Hello! Yes, I believe this could be considered an SPA. Initial request will pull down the HTML, CSS and JS. Then, interactions from the user (answering questions) will rewrite parts of the page (i.e. show the correct answer, build new question) via Javascript. There will be no calls back to the server involved: the logic is all in the script. The user could, optionally, load a CSV file ("word1","definition1") from their computer to replace the default 'questions' variable in the code with custom vocab. Input is escaped and reloading the page will wipe that out, of course.
    – SprocketTheSpaceDuck
    Jul 26, 2021 at 19:30
  • 1
    Thank you: I appreciate your help!
    – SprocketTheSpaceDuck
    Jul 26, 2021 at 22:37

1 Answer 1

Reset to default
0

In case of user submitted inputs, client side code injection, is still a potential risk considering the app uses itself: an attacker could use it to make the user perform unwanted actions (eg. delete vocab files), spy user behaviour within the app, and load external, possibly harmful and misleading content.

Worse, an attacker could steal information only known in the context of the victim's browser and transmit it to an attacker's endpoint afterwards, like cookies and session variables for example.

Even worse, but also uncommon, an attacker could combine those types of flaws with browser vulnerabilities in the sandboxed JS execution and browser access to hardware.

In your case, since the web server has only a few purposes, you should look for DOM-based client side code injection, typically javascript but not limited to it. Since you do not use a particular framework, you should consider input validation based on whitelist and escaping. A strong and correctly implemented Content Security Policy is also useful. If you plan to use Cookies, consider using secure cookie attributes.

I suggest you to take a look at resources that can guide you with Dom-based XSS good practices: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .