Source code disclosure vulnerability

Question

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like this:

/* SomeProgram v1.1 <http://www.somewhere.com/software/>
Copyright (c) 2010-2012 Dorothy
This software is released under the GNU License blah blah blah.....
*/
var variable=function(){ ... } // and so on. A bunch of js code

Is this called a source code disclosure vulnerability ? Or is this the correct behaviour? thanks

Answer 1

That is the correct behavior. In the case of client-side JavaScript, it is by design that the script source is sent to the client to be executed. So, the fact that you can manually browse to the URL for the script file is irrelevant. It gives you no more access than the application intends for you to have.

A source-code disclosure vulnerability is when the client can access server-side source code that it should not by design need or be able to access, such as PHP or ASP.NET source code.

Answer 2

A source code disclosure vulnerability is an involuntary disclosure of source code. Since JavaScript code runs client-side, on the browser, it's disclosure is intentional. Under this definition, only exposure of the server-side code is a source code disclosure vulnerability.

The example you give actually has the GPL on it, so it's already disclosed completely.

Note that with respect to security software, we like the source code to be available anyway - that allows us to inspect it (the full-disclosure principle).