Questions tagged [javascript]
The common name for the language used primarily for scripting in web browsers. It is not related to the Java language. Standardized as ECMAScript, its dialects/implementations include JavaScript and JScript.
163
questions with no upvoted or accepted answers
5
votes
1
answer
246
views
XSS security concerns from untrusted parent domains
There's lots of discussion about protecting content on example.com from user controlled content on subdomain.example.com (e.g. Github pages). What are the risks the other way around?
If my content is ...
- 161
5
votes
1
answer
365
views
What's the worst security issue what can happen by using eval() in Android WebView?
I've come across a hybrid Android app - meaning most of its UI is implemented in a WebView using HTML and JavaScript technologies. The app itself is connecting to the server and one of the possible ...
- 537
4
votes
2
answers
362
views
A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern?
Suppose that we have this code (in TypeScript syntax):
function one(str: string): string {
// do something with the string
return str
}
function two() {
let s = getSomeString() // returns some ...
- 71
4
votes
0
answers
924
views
In memory local variables (javascript), OAuth token storage, and XSS
Quoting from a long-dead Auth0 forum post: https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742
"Any values stored in memory are still vulnerable to XSS attacks since
...
- 141
4
votes
0
answers
897
views
XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)
The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy.
Setup:
SPA (Reactjs and ...
- 141
4
votes
0
answers
116
views
What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?
I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
- 141
4
votes
0
answers
1k
views
Is it safe to use DOMParser to parse client side XML files?
Some JavaScript frameworks or libraries use the DOMParser API to parse XML files from the client.
Is it safe to do this? Malicious code can easily be embedded into the XML file (in either the ...
- 873
4
votes
0
answers
325
views
How to indicate that content in an iframe is untrusted
As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
- 141
3
votes
0
answers
127
views
CSP for iFrame without any src attribute
I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
- 31
3
votes
1
answer
393
views
Securing a Node.js REST API for React.js webapp as well as a standalone API
I'm trying to create a secure method of authentication for my Node.js REST API that will work both for direct API requests as well as from my React.js web application. I've done some reading on how to ...
- 31
3
votes
0
answers
378
views
Sandboxing untrusted JavaScript execution by redeclaring variables
Some irrelevant background (read only if you want to say "no, just use an iframe")
Scenario
Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
- 131
3
votes
2
answers
818
views
How can user send malware code via input=file
After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
- 139
3
votes
2
answers
769
views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
- 171
3
votes
0
answers
2k
views
How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?
Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example:
a browser game in which the player's level and progress are to be saved locally.
a game,...
- 131
3
votes
1
answer
5k
views
Security risks with setDomStorageEnabled(true) in Android?
What are the security risks associated with enabling setDomStorageEnabled(true) method?
Reference.
- 89
3
votes
0
answers
400
views
How to remember the trusted machine in an application
We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
- 31
2
votes
3
answers
192
views
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
Can I visit a malicious website by using Tor with settings set to safest or by using NoScript on an ordinary browser with settings set to untrusted?
If not then is there any way to visit a malicious ...
- 31
2
votes
1
answer
254
views
Website with embedded PDFs and JavaScript for Acrobat
Context
On my website, users can upload their PDF files, and then some, other users can view the uploaded PDF files.
I was wondering if this could come with security issues.
The uploaded PDF are ...
- 21
2
votes
0
answers
742
views
Progressive web app, Access token storage
I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
- 21
2
votes
0
answers
708
views
Implementing Checkmarx suggested clickjacking fix introduces high severity Client DOM XSS vulnerability
My organization has scanned our code using Checkmarx and the low severity issue Potential Clickjacking on Legacy Browsers was detected due to a JavaScript function firing on an HTML image click event.
...
- 21
2
votes
1
answer
770
views
Is it possible to launch XSS if only the left angle bracket is encoded
I find some website only encode the left angle bracket of inserted HTML tag, for example:
<div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
- 685
2
votes
0
answers
277
views
iframes, user generated content and scripts
Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
- 21
2
votes
0
answers
313
views
Persistent HTML form data across sessions
I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how.
UserA logs in
Fills form with custom data
Logs out before sending ...
- 149
2
votes
0
answers
1k
views
How to secure an API key from client side?
I'm having an issue and I'm pretty sure I'm not the first on that.
I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is.
I provide an API that converts HTML ...
- 2,659
2
votes
0
answers
221
views
How to secure communication between page and browser extension?
In my browser plugin I want to detect any use of a built-in JavaScript function. I override this function by injecting a piece of code onto the page. This code then triggers an event, and an event ...
- 28.9k
2
votes
0
answers
530
views
Injected Javascript in my HTML document
Recently I noticed following javascript on several of my pages (usually just before closing body tag):
<script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
- 121
2
votes
0
answers
790
views
Security risks with pdf files in object tag at client/server side
This is my situation: a user uploads a pdf file to my server. The data travels encoded in base64 (like a regular input in a form). The base64 is saved in one particular file on my server. Now, another ...
- 21
2
votes
0
answers
2k
views
Validating user input in authorization header (node.js express-validator)
I am using Node.js and express-validator to validate user input server-side. The form I am controlling is simple to validate, by ensuring that constraints are being met such as "isInt" and "isFloat", "...
- 61
2
votes
0
answers
340
views
Authenticate with ADFS without Javascript?
I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS.
Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
- 121
2
votes
1
answer
3k
views
Securing a JavaScript Single Page App with SAML
I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options?
Details: I have worked with OAuth2 in the past, but I ...
- 121
2
votes
0
answers
672
views
Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?
I'm currently writing a web application that will need to be HIPAA compliant.
It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
- 153
2
votes
0
answers
133
views
Can static analysis of JavaScript be done?
Is it possible to statistically analyze JavaScript to find obfuscated JavaScript? Any algorithms or equations with coefficients that can find obfuscated JavaScript?
2
votes
0
answers
192
views
Suspicious web-application requests containing encoded JavaScript function(?)
I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before.
The raw requests were variations of:
...
- 21
2
votes
0
answers
543
views
How does JavaScript Injection work?
I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...
- 121
2
votes
0
answers
1k
views
XSS Vectors for new Image()
What are possible XSS vectors to this JavaScript code
new Image().src = encodeURI('[user url here]');
Let's assume two cases:
[user url here] is some string provided by user (with no validation)
[...
- 2,837
2
votes
1
answer
223
views
DBus proxy Javascript binding issues
Gnome 3 (under GNU/Linux, BSD or other Un*x) now offers a gnome shell with nice presentation, but where the configuration and theming are to be done via a web browser (and a public URL, on a public ...
2
votes
1
answer
447
views
How to avoid crash after successfully run shellcode?
I am a student studying information security. Recently I read this article link and made full exploit code. calc.exe is executed as expected. But after running shellcode, IE just crashed. (because no ...
- 21
1
vote
0
answers
18
views
force XSS after bypassing Request.Form using URL Encoding
I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input.
My focus in this ...
- 11
1
vote
0
answers
99
views
Client-side Javascript injection by assinging the output of window.location.href.substr to a variable
Sample code:
function winLoad() {
var sessionId = '';
if (window.location == window.top.location) {
var semicolonIndex = window.location.href.indexOf(';');
if (semicolonIndex !=...
- 11
1
vote
0
answers
77
views
Is this a LFI vulnerability?
I'm playing with uploads, so I'm wondering if this route is safe to use, because if you somehow break off from the md5 function path, then you can control the path (if in TypeScript null byte is a ...
- 13
1
vote
0
answers
24
views
Can the data between Express.js middleware be manipulated/tampered in any way?
In the node.js express.js framework there is middleware support. Let's assume I have two middleware - the first one, which verifies whether the JWT token is legit and not tampered with and the second ...
- 234
1
vote
0
answers
125
views
Possible window.location.hash DOM XSS
I've recently gotten into web security and javascript and I think this looks like apretty promising DOM XSS:
let hastagIntentos = 0
, posAnterior = 0
, reintentosHatagPos = 0;
function ...
- 11
1
vote
0
answers
842
views
Checkmarx Client DOM XSS Violation in ReachJS
I have this message from Checkmarx:
The application's = embeds untrusted data in the generated output with location, at line 19 of ****.js. This untrusted data is embedded straight into the output ...
- 111
1
vote
0
answers
48
views
How to debug javascript code with Windows functions on Linux?
I am a beginner in analyzing javascript code on Linux and whenever the code is for a Windows machine I cannot proceed with debugging because there are undefined functions.
Examples:
GetObject(_6078(1),...
- 13
1
vote
0
answers
118
views
Need for URL encoding in XSS / CORS lab
I am doing one of Portswigger's labs on web security, specifically CORS (cross origin resource sharing). I am having trouble understanding why there is a need for URL encoding certain parts of the XSS ...
- 11
1
vote
0
answers
87
views
What is the value of no paste text boxes for bank web sites?
HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
- 121
1
vote
2
answers
80
views
How to mitigate risk of exploiting open POST endpoints?
I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.).
I'm owning a web application that exposes some HTTP endpoints to the world. ...
- 11
1
vote
0
answers
107
views
Re-populate form with JSON data
I re-populate form with JSON data via javascript (all data has the same origin server)
1 Wen the page load, make a request post ajax
2 The response Ajax is a:
Object { primary_ns: {…}, secondary_ns: {…...
- 21
1
vote
1
answer
91
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
- 11
1
vote
0
answers
36
views
How to prevent XS-Leaks while maintaining usability?
The methods presented in https://xsleaks.dev/ are based on the fact that malicious Javascript can use Cross-origin requests to infer data by means of faulty status codes, time required, mime type etc. ...
- 53