Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [javascript]

The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

How to turn a relative path script (js) import to an absolue one with a url for XSS ? (more details below)

I have a parameter whose value is injected in the HTML as the following <script src="/dir1/dir2/dir3/dir4/INJECT_HERE"> </script> I was able to traverse back to just / but when ...
user avatar
0 votes
1 answer
33 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
user avatar
0 votes
0 answers
24 views

How can I inject JavaScript into a url whose contents will be written to the DOM in a way that it could execute?

I'm working with the API for a popular CI/CD app and I found a bug where path variables are being written directly to the DOM without being checked first. The tldr is that to access a project you go ...
user avatar
2 votes
2 answers
70 views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
user avatar
  • 205
0 votes
0 answers
12 views

Threat Assessment Javascript User-controlled Variable Names on Window

I have a requirement to support some external integration to a 3rd party vendor on our site (which is a SaaS site with multiple tenant logins). The vendor requires a script and a global variable to be ...
user avatar
1 vote
0 answers
42 views

Re-populate form with JSON data

I re-populate form with JSON data via javascript (all data has the same origin server) 1 Wen the page load, make a request post ajax 2 The response Ajax is a: Object { primary_ns: {…}, secondary_ns: {…...
user avatar
9 votes
2 answers
2k views

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail. Today I cleared the browser data except for the autofill stuff. Then I went to Stack Exchange to register an ...
user avatar
  • 107
0 votes
0 answers
46 views

XSS - Anyway to bypass double quotes in href of anchor?

I have an anchor that has href attribute populated by my input. I am trying to input javascript, but it always renders it useless since it always appears between double quotes. So far, I have tried ...
user avatar
0 votes
1 answer
32 views

Can javascript from parent page read url of popup window?

Lets say I'll open a third party page from the parent page using window.open(popup method) Now what I want to know is there any way where the parent page(using javascript or any third party library) ...
user avatar
  • 1
0 votes
0 answers
23 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
user avatar
0 votes
1 answer
44 views

unknown (malicious?) code and file in public dir (Laravel 5.8, apache/cPanel) [duplicate]

I have a Laravel 5.8 app in a server running Apache/2.4.53 (cPanel) and PHP 7.4 (ea-php74) and i have VPS root WHM/cPanel access there. as any Laravel project, the "public" directory is web ...
user avatar
1 vote
0 answers
25 views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
user avatar
0 votes
1 answer
51 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
user avatar
0 votes
0 answers
22 views

Explotation of reload/redirect through javascript

While working on a site (https://website.com/site/site.apexp) the site redirects through a javascript function: <html> <script> function redirectOnLoad() { var escapedHash = ''; ...
user avatar
  • 1
3 votes
1 answer
79 views

Website with embedded PDFs and JavaScript for Acrobat

Context On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files. I was wondering if this could come with security issues. The uploaded PDF are ...
user avatar
  • 31
0 votes
0 answers
76 views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
user avatar
0 votes
1 answer
46 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
user avatar
  • 105
0 votes
0 answers
39 views

Best way to encrypt client side data for SaaS inside the web

I am planning a SaaS-solution, where my clients store and save sensitive data on my servers. Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
user avatar
0 votes
0 answers
59 views

Why would iexplore.exe run Wscript.exe?

In Windows logs, I found that C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe launched C:\Program Files\Internet Explorer\iexplore.exe" -dualengineadapter... which in turn launched &...
user avatar
15 votes
6 answers
6k views

Preventing users from tampering with input

Let's say that I have a single-page web app written in JavaScript and a server-side API, both changeable by me. The app calculates some values based on user input and POSTs these to the API. The ...
user avatar
  • 315
0 votes
0 answers
56 views

How to perform php post request attack with javascript sanitization?

The following code demonstrates the source code of this challenge and basically, I need to send a post request with arbitrary code to execute on the server. However, after multiple attempts Im unable ...
user avatar
1 vote
0 answers
33 views

How to prevent XS-Leaks while maintaining usability?

The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
user avatar
1 vote
1 answer
83 views

Can an attacker mess with a website that doesn't use a back-end server? (and how I can prevent that)

I'm developing a React web app where the user can input a .csv of their transaction data, and the app will output useful analysis that will inform their future purchase decisions. I'm planning to use ...
user avatar
  • 11
0 votes
1 answer
90 views

XSS attack not executing with correct payload

Hello I was testing on a private program where I was able to inject XSS but for some reason it is not popping up when I put the mouse over the input field. <input type="text" onmouseover=&...
user avatar
0 votes
2 answers
124 views

When receiving PDFs from unknown sources, is it sufficient to remove dynamic content (flash, JS, etc.) to minimise attack surface?

My company allows customers to upload PDFs, JPEGs and PNGs to our servers, which are then viewed by clients. We want to minimise the potential for attack on the clients, and while the image formats ...
user avatar
0 votes
1 answer
56 views

Can POST request be changed in a HTTPS website?

I am trying to develop a website where I grab data using javascript and send it to PHP using ajax post. However, while researching, I found that the POST request can be modified using third-parties ...
user avatar
0 votes
2 answers
96 views

Does the HTTP status code 302 guarantee no other content was served as part of the same HTTP response?

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A? The ...
user avatar
2 votes
2 answers
91 views

Javascript based attacks when not having JIT

Some browsers like Chromium and recently Edge have a flag to disable JIT. What attacks/threats does this protect against and what JS based attacks are not prevented?
user avatar
  • 31
2 votes
1 answer
295 views

Can XSS ever occur in an <img> tag's "src" attribute?

In a scenario where an attacker has control over the src attribute of an img HTML tag, they could easily inject a simple JavaScript XSS payload like the following: <img src="javascript:alert(1)...
user avatar
  • 123
0 votes
1 answer
90 views

COOP and COEP: Is there an advantage to enabling COOP / COEP if I don't need to use the sharedArrayBuffer or other features?

COOP: cross origin opener policy COEP: Cross origin embedder policy Most of the articles on the web, related to COOP / COEP, point to the fact that by enabling COOP / COEP , your web page can use the ...
user avatar
0 votes
1 answer
161 views

HTML Option Tag XSS

Is it possible to inject javascript inside of an HTML option tag? For example, say you have the following html: <select> <option MALISCIOUS_CODE_HERE>Option Description</option> &...
user avatar
0 votes
0 answers
70 views

Values inserted with the JavaScript "value" property are ineffective

Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
user avatar
0 votes
0 answers
56 views

Can malicious code running in isolated Electron's renderer process send data to attacker's server?

I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...
user avatar
0 votes
1 answer
458 views

Decoding suspicious Javascript

I received a suspicious looking SMS today with a link. I checked out the page source code and came across this script between the <head> tags: <script async="" src="/cdn-cgi/...
user avatar
  • 186
2 votes
1 answer
80 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
user avatar
0 votes
1 answer
121 views

Could this code be vulnerable to XSS?

It seems like exploiting XSS is becoming harder with every browser version update. My question is: Is this code vulnerable to XSS? <script type="text/javascript"> var url = ...
user avatar
0 votes
0 answers
65 views

Constant-Time String-to-Byte Encoding for JavaScript

When dealing with cryptographic secrets (private keys, passwords, etc) it is desirable to not run these secrets through functions that do not run in constant time, in order to avoid the potential for ...
user avatar
0 votes
1 answer
79 views

Is it secure to send messages between a WS Server and the client?

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...
user avatar
7 votes
2 answers
2k views

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

This question may be a little off-topic, but is Math.random the same as crypto.getRandomValues? (JavaScript) Here's an example: Math.random(); // 0.11918419514323941 self.crypto.getRandomValues(new ...
user avatar
0 votes
0 answers
69 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
user avatar
0 votes
0 answers
86 views

Can SVG be a potential threat for tracking scripts and similar?

Since SVG files can have JavaScript, which would get executed is it a potential threat for malware, tracking scripts and similar stuff?
user avatar
  • 200
0 votes
2 answers
144 views

XSS payloads getting filtered but HTML tags are getting rendered. Can we exploit this? [duplicate]

I was trying to test a potential XSS vulnerability on a website. On the search bar I can see the filtering process happening i.e if I type script> (not with starting <) I can see the same in the ...
user avatar
-1 votes
2 answers
155 views

Keep encryption password in javascript file hidden from browser debug tool

I'm sort of new to Frontend programming. I'm trying to build a PWA, it stores data (client data i.e: address, name, phones) to be ready in an offline state, for which I'm using localForage. I've ...
user avatar
0 votes
0 answers
106 views

Selective frame busting without HTTP headers

Why... Just Why... Due to Shopify being unwilling to modify security headers further then removing them, the Cloudflare "Orange-to-Orange" problem (since Shopify uses Cloudflare as well), ...
user avatar
  • 21
0 votes
0 answers
77 views

How can an external js file be securely added to a jinja2 template with csp?

Recently started with web security and came across to CSP. The idea is to implement js file to base jinja2 template and to use it on one of the templates. <script type="text/javascript" ...
user avatar
1 vote
1 answer
165 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
user avatar
2 votes
1 answer
238 views

XSS inside of a javascript string, with unusual filter

While making a website I made an interesting mistake, and I'm wondering if this could be used to achieve XSS. I've come very close, but not quite. I can put my user input into a string inside of a <...
user avatar
  • 123
0 votes
0 answers
21 views

Decode malicious javascript [duplicate]

Probably as most of Facebook users I receive many malicious requests with link and JS. I usually delete or ignore them, but now out of curiosity decided to research it. I've unsuccessfully tied some ...
user avatar
  • 101
0 votes
0 answers
109 views

How do developers prevent a third party from looking at exposed information on a javascript console? For example on a public computer

If a user was using your application on a public computer and were to log out of your website without closing the tab, the next person to use this computer could snoop through the console and look for ...
user avatar
0 votes
2 answers
139 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
user avatar
  • 103

1
2 3 4 5
26