Currently I am using OWASP Dependency Check to find and mitigate known security issues in third party jars. Is there any similar tool/app to check for known security issue in third party JavaScript?


This may seem like a lame answer to you but my rule of thumb is pretty simple and cheaper than trying to validate third party JS libraries

  1. Only use well-known, actively maintained, patched libraries like Jquery. Look at the list of libraries available on Google and that's a great hint you are dealing with reliable code

  2. If you are rolling your own, or on the bleeding edge - there is JS Lint. In my experience, almost all security vulnerabilities are due to bugs - see http://www.jslint.com/

  • Thanks @danny.. We are only using well-known, actively maintained library... Sometimes well-known library may also have issues which they fix in next version. I want to be updated when third party js library fix some security issue. – user116017 Sep 13 '15 at 18:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.